621 comments

[ 0.21 ms ] story [ 317 ms ] thread
Really weird, anyone have some inside gossip on what this is about?
The most optimistic reason would be that they were investigating a supply-chain attack, or something of that nature.
This makes me wonder... it's entirely possible that the PyPI people would be enthusiastic about helping to track down offenders, and their users might agree, _if they knew what the offense was_. Instead, they're presented with a typically antagonistic demand for details, so they understandably get defensive on behalf of their users. I wonder if there's not a better, less heavy-handed way to get cooperation with law enforcement when the request is reasonable.
Personally I would rather not set a precedent of handing data over to government agencies just because they ask nicely, even if it seems like it's for a mutually agreeable good cause. That is, I would rather they go through these "formal" channels, even if it seems a bit heavy-handed.

Further, whatever they're investigating here is probably "important", for some definition of important, so they likely value the ability to lean on non-disclosure clauses etc.

I wish it was that but those people would be smart enough to not use their real name when signing up - those doing supply chain attacks are often at least somewhat professional and take precautions.

I suspect it was more about going after software that was enabling piracy, those are often created by naive students who are not expecting the power of government to be unleashed on them.

> those doing supply chain attacks are often at least somewhat professional and take precautions.

Not really.

The vast majority of supply chain attacks in practice are idiots exploiting namespacing, bitflips, or typos on pypi/npm to drop miners or infostealers.

Yes, even the shit tier supply chain attacks count :)

It could be related to the large number of malicious or booby-trapped packages that have been uploaded recently to the index.
My guess? A hacking case against someone for typosquatting or malicious packages or something.
Could be anything I guess, even legitimate reasons. T Think of the supply-chain attacks going on in the past few years. I'd say investigating these would be a legitimate reason for a subpoena.
(comment deleted)
I love this level of transparency.
Yeah, whether necessary or not, it's still nice to have such a level of detail in a transparency report.
> We will not be releasing the usernames involved publicly or to the users themselves.

Which is the most important part.

They're not allowed to release that.

Edit

I read 'chaps as saying there was an NDA on the subpoena, but apparently there wasn't, so this might just be flatly wrong.

The NDA isn't the only reason you don't risk interference in an ongoing investigation though so regardless the basic point still stands.
Even in the absence of NDA, are you allowed to? Counsel has apparently advised them not to. Would it not carry the risk of being complicit to a crime?
Disclosing facts is not a crime.
There are lots of situations in which disclosing facts is indeed a crime. You are answering my specific question with a nice sounding maxim which is obviously not true in general.
Perhaps there is no NDA on the fact that subpoenas were issued, but still an NDA on whom they were issued about? Limiting The scope of such an NDA feels like a plausible result of negotiations after a motion to squash the subpoena.
Releasing the user names would not be respecting the privacy of the users.
Sure. But I would love if they had considered this from the start:

>As a result we are currently developing new data retention and disclosure policies.

“I guess we don’t actually need that” should have been the idea from the start.

After a quick glance at the information listed in the report I didn't notice excessive data collection on pypi's part.

I'd say they followed "I guess we don't actually need that" approach reasonably well so far and good for them if they want to improve that even more.

One important thing to remember here is that PyPI was originally started in 2002 as a weekend hack project that grew overtime to become the piece of critical infrastructure it is today. There's a lot of stuff in PyPI that exists as historical baggage and cruft and reviewing them just never bubbled up to be a priority. Likewise a lot of the policies it has have been added and grown overtime as something happened that caused us to need one.

On top of all of that, it's volunteer run and has been understaffed for basically it's entire life, so sitting down and figuring out a proper data retention policy that takes a holistic view of everything we have just never bubbled up.

In general I think we already do a pretty good job of collecting a minimal amount of data, and hopefully with proper policies we can do an even better job.

Do you still love it if it enables a terrorist or otherwise very bad person to evade capture?
Not OP but yeah. I don't buy into the whole "to protect you from bad people I need to erode your rights" argument.

Never made sense to me. Terrorists and other very bad people usually aren't in the business of following laws so I don't know what crimes you'd prevent by weakening the rights of everyone else.

I mean, surveillance reduces crime. Wherever you fall on the spectrum of surveillance/privacy, I can guarantee if the government read everything everyone wrote/texted/read and recorded their every move, there would be less crime.
Great to know that. I'll let the parents of Uvalde know how surveillance reduced crime on the 1 year anniversary of the school shooting.

Surveillance does not reduce crime, tending to people's basics needs so that they don't need to commit crimes reduces crimes.

Is a subpoena of 5 specific users' data, presumably with the purpose of getting evidence about things that already happened, the same as 'surveillance'?

> the government read everything everyone wrote/texted/read

is this really a relevant analogy for this? And yes, I've heard of the mass surveillance via telco that we did find out (through Snowden) was happening, and do think it seriously crossed the line. I'm just wondering if this kind of case at issue has anything in common with that malfeasance at all.

Is it your belief that they lacked any probable cause and are actually trying to persecute those 5 people for some reason?

Rather than try to argue against a position I'm not fully understanding, I'd like to hear how you think police should solve crimes with a significant "cyber" component.

To be clear, I'm not advocating for it. But if people couldn't use the internet/communications to plan or communicate criminal activities, crime would reduce (to some degree, meaningful or not).
I'm very unaware exactly what the issue is with this particular case, so be gentle, but what is the difference between the government agencies doing their job to stop criminals, and evil rights-destroying which it sounds like you are clearly convinced is what's going on?

Let's say someone stole your identity and in the process they emailed all your financial documents to example.anon12345(at)gmail. If you contacted the police and the FBI subpoenaed Google to force them to give them the details of whatever they know about that accountholder, is that bad and hurting the rights of somebody, or is it protecting your rights?

Does it change based on the despicableness level of the crime suspected? From one count of copyright infringement of a Taco Bell commercial, to organized retail theft rings, to identity theft, to CSAM, to terrorism?

I'm not saying you're wrong, I'm just curious what the "We hate subpoena power" argument is so I can decide where I stand on it. I feel mildly like I'm not as bothered as you are, but I suspect I'm missing something.

Also, should "online" operate under different rules than offline? If the "feds" have probable cause that some guy is a drug kingpin and they break into his office and his safe to seize evidence, is that equally bad as forcing Google to open up his Gmail account for them?

Climate activism is also being considered an act of terrorism by some now (particularly some Christian party in Germany), dunno if those people label themselves as 'very bad persons'. Probably goes for all terrorists, but this might be easier to relate to as it's grounded in reality and we'd likely agree with the change they seek

Child porn and terrorism are the favorite subjects of politicians looking to enact a new law but idk if it's good to follow that thinking and use it as an example as opposed to a serial killer or something

Yes. Truth itself stands at the top of the moral hierarchy. It can stand alone without any justification. "You told the truth" will never be immoral, consequences be damned.
I can't tell if this is sarcastic.

While they are transparent the events happened, they are not transparent about which packages and what authors are being flagged, which is unfortunate.

Is it possible that they can't publish that? Perhaps even not allowed to say that they can't publish that?
> While they are transparent the events happened

Considering they are admitting they will always obey government commands, including regarding non-disclosure of actions to affected users, it is prudent to assume they are, in fact, not transparent about events; only about those events which the government has let them tell you about. Other events (e.g. National Security Letters) may or may not have occurred.

> We will not be releasing the usernames involved publicly or to the users themselves.

Why not to the users themselves? Have they been prohibited from doing so? (TFA does not say afaict)

That, or they have reason to believe the investigation is legitimate and they would prefer not to hinder it.
They say very explicitly that they do not know what it was about.
There's a wide gulf between concrete knowledge and belief.

I see an ambulance going lights-and-sirens behind me. I don't know they're on their way to or from a hospital, but I pull over because I have reason to believe they are.

Weird analogy. An ambulance has a very narrow scope of responsibility. Legal processes have a very wide scope. Clearly this is related to a legal matter and not an immediate medical matter. But the nature of the legal matter could be a very wide variety of things, ranging from lower court civil proceedings up to treason, etc.
they have five usernames... that can narrow down what projects they were associated with pretty quickly to infer if there was something nefarious about them. though it could be entirely unrelated to their activity on pypi and be a trawl for leads based on username similarity from some other messageboard or activity that was used for illegality. though, thinking about it more, that seems legally dubious a reason to be able to get a subpoena issued for. ianal
They only wrote that they weren't told what it was about. However it might be obvious from the packages uploaded by those users (e.g. if they uploaded malware).
Often subpoenas are part of an ongoing investigation, and they require not releasing information to those who’s data was subpoenaed.
The why: notifying a suspect in a criminal investigation could allow them to flee or take measures to avoid prosecution, destroy evidence, etc.
The subpoena probably includes a nondisclosure clause; a court order certainly would. The mechanics of nondisclosures on subpoenas is interesting and I don't totally understand it (by definition, a subpoena is a document authorized by someone other than a judge).
So is this message a way to obliquely signal to those users (whoever they are) that they may be under investigation without actual disclosure?
I doubt it. Most of these investigations (really: most federal computer-related investigations) are super boring, and are about things ordinary people wouldn't object to seeing investigated.

We're a message board and we're thus optimized for drama over truth-seeking (it's just human nature). The truth of these kinds of events is usually not all that interesting. If it's something more dramatic, we'll hear more about it in the future. In, like, a sort of Bayesian sense, you can predict that any given subpoena or court order is going to be about a case nobody would bother sending warning signals about.

> Most of these investigations (really: most federal computer-related investigations) are super boring, and are about things ordinary people wouldn't object to seeing investigated.

This is true. The result may be so boring local news wouldn’t even cover it. In some cases you have to find the investigating agency’s unremarkable press release and then dig for related court documents to even find out what happened.

That might get PyPI into trouble especially with a gag order which we can assume that they are forced to obey and forced not to talk about.

PyPI would pretty much want to inform the users, but they probably simply can't (without getting into legal trouble).

(comment deleted)
There was no NDA:

  "We have waited for the string of subpoenas to subside, though we were committed from the beginning to write and publish this post as a matter of transparency, and as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023."
(comment deleted)
Interesting! (I initially read this backwards and thought you were saying they did have an NDA).
… for the suppoenas received in March and April 2023
Yeah, that was notably strange language for sure.
> by definition, a subpoena is a document authorized by someone other than a judge

Uhm, am I misunderstanding what you wrote, because that is definitely not true. Subpoenas require an officer of the court by definition (in the US anyway), which can be a judge, a court clerk, or even lawyers in some jurisdictions.

Can a court clerk or a lawyer unilaterally create a nondisclosure requirement? It is not generally that case that a lawyer, absent a judge, can send you a document you're not allowed to disclose (though certainly lots of C&D's try to suggest otherwise).

I'm sure the NDA stuff here is ironclad! I'm just curious what the mechanism is.

> Can a court clerk or a lawyer unilaterally create a nondisclosure requirement?

If they are acting as an officer of the court, which they’d need to be to sign off on a subpoena, I believe the answer is yes. The mechanism is called a “gag order”.

For subpoenas authorized under the Stored Communications Act, there's statutory authorization for DOJ to request time-limited NDAs, which makes me wonder if there needs to be explicit authorization for other kinds of subpoenas. This is the kind of noodling I'm doing here; I'm not trying to message-board my way to a first-principles argument that the NDA was bogus. :)
I don't follow you, which NDA?
It's very common for a subpeona related to an ongoing investigation to include a gag order. For instance, if someone is investigating someone for a crime, and requests that users search history, the last thing they want is for Google et al to alert the user that this happened, as they may not be ready to arrest them yet and the target would flee.

Same with wiretapping orders, or frankly a subpeona for pretty much anything from a third party.

> Subpoenas require an officer of the court

That's not entirely true.

https://en.wikipedia.org/wiki/Administrative_subpoena

Local organizations have come up with equivalents, although there is less (no?) statutory support for that.

> Subpoenas require an officer of the court … or an agent working for the government

I left off the second part after the ellipses because it’s not relevant to the current discussion and because there’s constitutional challenges against them even when federally issued, as your link calls out. I didn’t want us to tangent off needlessly. The law is a messy place, lots to find and hate.

The users themselves already know their own usernames, presumably. They could let the users know they were subpoenaed without letting them know their username. :P
[In March and April 2023, the Python Software Foundation (PSF) received three (3) subpoenas for PyPI user data. All three subpoenas were issued by the United States Department of Justice. The PSF was not provided with context on the legal circumstances surrounding these subpoenas. In total, user data related to five (5) PyPI usernames were requested.]

either a small group of users, or one user with multi aliases wrote a nastyapp ?

Apparently no plans to set up a canary.
Why would they? It's a public repository, nothing confidential or private
Account details are confidential and private.
Is there any precedent for people not facing legal consequences for failing to update the canary? The subpoena probably says "and also update your warrant canary to say there were no legal requests." Now you're in contempt of court and in jail for 5 years while you wait for your "compelled speech" case to go to the Supreme Court.

In general, I think it usually goes poorly when programmers invent clever legal workarounds. The legal system isn't a computer program. It's guys with guns.

Isn’t the idea that the (US) government can’t (technically) compel you to lie?
The process is the punishment.
That may be the case but if the cost of testing it is 5 years in jail while the case works it's way through the courts, few people will be willing to rely on it.
The better question is: are you (or PyPI in this case) interested in a legal tussle with the US Gov?
The US compels certain kinds of speech all the time.
The US government is not compelling speech, it's compelling PyPI to accurately reveal to the US government the contents of past speech that PyPI has access to. Compelling disclosure of certain kinds of data, when it's known, is a normal part of legal actions in the US and probably elsewhere.
You seem to be describing what these subpoenas have requested. This thread is about canaries, and whether the government could compel a company to keep one updated against their will.
You can beat the wrap but not the arrest.
I would think there are certain situations where a person might be compelled to lie, such as if you have a security clearance, have signed an NDA, or are acting as an informant. That is, a person may have to lie to prevent divulging classified or secret information through implication.

EDIT: One situation where the government cannot compel you to lie is if it violates your fifth amendment rights (self incrimination).

those are all things you actively agreed to, in advance, in exchange for some sort of consideration (job, not going to jail for illegal things you've already done, etc)
"Just because you're right doesn't mean you won't go bankrupt in a court of law proving it."
I have never heard any legally competent source say that the U.S. government cannot (with warrant or whatever) compel you to lie. I'm pretty sure that, in the case of a canary, they can.
Please, we do it routinely. They're called "informants."

At the end of the day if uncle Sam demandeth, uncle Sam will haveth.

Exactly. Warrant canaries are security theatre.
Not always, if the entity has a stance to uphold and the money to fight back, it doesn't have to be.

If a mom-and-pop shop or open source org, it's a faint hope at best.

Can you provide any evidence of the US forcing someone to update their canary?
How would one even observe this evidence?
The only way I can think of would be that after the case has ended it may be possible for a party who had been directed to update a canary under a court order to notify people that they had done that. It would probably depend on the court etc and I am not a lawyer.
> The subpoena probably says "and also update your warrant canary to say there were no legal requests."

I think that would be outside what can be done with a subpoena. It would require a court order.

If you can just say, "We got subpoenaed" in a blog post, isn't that even more effective than a canary would be?
Canaries would be for times when they couldn't legally say that.
Canaries probably don't work, which makes them worse than theater.
Long ago, Apple included a warrant canary in their transparency report. One day, it disappeared. Nothing came of it.

https://www.theverge.com/2014/9/18/6409575/apple-warrant-can...

The problem with a warrant canary is there's too much doubt about why it disappeared. Did they actually receive a warrant, or is it just a decision from corporate to discontinue the practice?

There can be some doubt, but too much?
A decision from corporate to discontinue is also a signal.
> why it disappeared

The result is the same.

I don't understand (genuinely, I'd like to!) what a warrant canary would have done here: this was a subpoena, not a warrant, and PyPI is a public package index.
I'm obviously talking about a subpoena canary.
I'm guessing some poor typosquatter managed to hit a gov agency and is about to get alphabet soup all over him.
That or fairly unlucky bug bounty hunters
“Get alphabet soup all over him”

This is my new favorite alternative to “vanned” (or “v&”)

I think I'm gonna snarf that one too. It's just too good.
Think I’m gonna snarf snarf. Actually I just looked it up and apparently that word means to eat or drink greedily. Not sure why you used it here
As in eagerly consume into poster's lexicon I think.
> “vanned” (or “v&”)

Also note that the noun associated with being "vanned" would be a "party van", not just a "van".

To be vanned/V& is to have the glowies inside the party van take the vanned party away.

https://knowyourmeme.com/memes/4chan-party-van

lots of nostalgia for partyvan.org during the chanology days
(comment deleted)
(comment deleted)
More likely it is DRM-cracking packages.
I'd like to put $5 on "ransomeware threat actors"
Putting my conspiracy hat back in the closet, I guess there is plausible reason to believe that someone used PyPI for fraud, CP distribution or some other crime.
accusations and planting evidence are everyday things in some security circles.. plus idiots abuse open systems.. not proof of malfeasance, maybe just a "setup"
I don’t understand how the information requested is relevant at all for any purpose. Most users of pypi merely download through pip; they arent registering anything. Furthermore, I would think a bad actor who would register would spoof their ip and use burner accounts anyhow.
Correlating IP address use to something else happening at the same time? Like a malware author being incredibly dumb and using their home IP to upload PyPy packages, while IDK, using that same IP as a C&C server endpoint.
They may not even need to have slipped up and direct-connected via their home IP. The FBI has sufficiently compromised subsets of Tor in the past to do correlative attacks on specific targets.
> Most users of pypi

Presumably the 5 users in question were interesting in some way, not just random.

> I would think a bad actor who would register would spoof their ip and use burner accounts anyhow

Maybe, but they could find that out with the information. If there's a 10% chance each was sloppy or un-paranoid, there's a 40% chance they get at least one piece of real info.

The person might not have thought they were doing anything wrong. Some judge might have greenlit this for a piracy case against the five maintainaers of youtube_dl{c} or something silly.

>We will not be releasing the usernames involved publicly or to the users themselves.

They point out that they are not subject to a gag order.

Yeah this is interesting, because they could in absence of the gag order but choose not too. Unless it’s not a gag order but a specific don’t tell these users anything?
I doubt any investigators worth their salt would let the people they're investigating know that they are investigating them before they're ready to charge them.
> associated with the subpoenas received in March and April 2023.

Oddly specific wording there. It would seem they have received additional subpoenas outside that timeframe which do have gag orders, and someone slipped up and failed to put the gag orders in these particular subpoenas.

Seems like the DOJ may be doing some long-term fishing for, what, software developers? First the DOJ came for the conservatives, and I said, "go get 'em!" because I wasn't a conservative; next the DOJ came for ____?

It's interesting how you manage to leap from what is probably a supply chain attack investigation straight into a pErSeCuTeD CoNsErVaTeS conspiracy.
Across the ages, government has applied a disproportionate level of scrutiny to groups and people perceived as dissidents, minorities, and anyone else who could potentially be conceived as a threat to institutional power regardless of the magnitude of the threat or if that threat is true or false. Historically this is a bipartisan issue, for decades the FBI vigorously attacked anti-war groups, black civil rights groups, and various left wing groups via COINTELPRO. I guess to summarize, the way I think of it is that the government is coming for anyone they see as a potential threat and it doesn't matter what the politics of that group are.
Step one: have position and power as part of a dominant group

Step two: style yourself as an oppressed minority

Step three: defend any action, decision, or position as a persecuted martyr

Dumb legal question; what's the difference, if any, between "We've been subpoenaed" and "Someone had a warrant for data"?
Warrant = we (police or other authority) have the right to come and search your property for evidence.

Subpoena = the court compels you to hand over the evidence we need.

Subpoenas are orders, but they're not necessarily court-issued. Warrants, on the other hand, are court-issued -- the police can't issue warrants on their own in the US.
(comment deleted)
A warrant for a things isn't an order to the owner of that thing. It's an order to (and peemission for) officers to go and seize the thing.

You get shown the warrant to prove that they have permission, not to order you to comply.

Yes, I'm aware -- my other comment says that.

I realize this comment is a little ambiguous: the order in the warrant case is an order by the court to the court's officers to perform an arrest, seizure, etc. It's not an order for you (the subject of the warrant) to comply.

Not a dumb question: a subpoena is an order to provide information or access, while a warrant is a court-issued document authorizing the government (or an agent of the government) to perform an act (e.g., an arrest, or seizure of an item).

Subpoenas can be issued by attorneys (including prosecuting attorneys) as part of the investigative and discovery processes.

Subpoena = "Ask firmly, but nicely"

Warrant = "Back up the van and haul it away"

The subpoena is a command to the possessor of the data, which tells the possessor of the data to produce it, with a particular deadline. Since this deadline is in the future, the subpoena can be challenged legally (normally by requesting a court to "quash" it; more riskily, sometimes by complying imperfectly or not at all, and then arguing in response to an attempt to punish the noncompliance that this was reasonable). A subpoena can be issued by many entities, for example including some law enforcement entities themselves, or a lawyer actively involved in litigation. (Yes, lawyers can personally write and issue subpoenas.) The subpoena is, however, enforced by a court, in the sense that the court is asked to punish people who fail to obey it.

The warrant is a command to a law enforcement officer, which allows the law enforcement officer to personally go and search and seize things (or people), while overriding some rights that would normally prevent this. Normally it is issued by a court. Generally there is no way to challenge a warrant to prevent its execution, because it is not disclosed to the target before it's executed (i.e., a law enforcement officer shows up with the warrant and begins executing it immediately, by force if necessary).

(Edit: I wrote above that it's risky to comply imperfectly with a subpoena and then argue in court that this was reasonable, but usually if a lawyer gives a professional opinion that the subpoena is invalid or overbroad for some reason, then the recipient of the subpoena won't be punished for following that advice. The lawyer may also attempt to negotiate directly with the issuer of the subpoena, for example by sending a letter explaining why the the subpoena appears to be invalid. The legal standards for issuance of subpoenas are also pretty broad. For civil litigation, which is not what DoJ is doing here, they are set out in https://www.law.cornell.edu/rules/frcp/rule_26; notably, they can be issued to third parties.)

Really nice response, I'm not the one who asked the question but I learned something from your response.
> https://www.law.cornell.edu/rules/frcp/rule_26;

This url does not exist. Was this response generated by an LLM?

> This url does not exist. Was this response generated by an LLM?

No, its just that HN’s automatic linkification continues until it breaks on whitespace, so if you type punctuation (here, the “;”) after a link with no intervening space, it gets included in the URL.

Strip the semicolon and its fine:

https://www.law.cornell.edu/rules/frcp/rule_26

Thanks! I probably should also have mentioned https://www.law.cornell.edu/rules/frcp/rule_45 (with no punctuation at the end).

But also I possibly shouldn't use civil litigation as the only example of subpoenas, again because this one arose in a different context.

> We will not be releasing the usernames involved publicly or to the users themselves.

Emphasis on the last part: or to the users themselves.

In other words: unless they actually let the users involved in spite of claiming the opposite, the whole article is complete posturing.

Does a "subpoena" mean a judge was involved? The post says the subpoena was issued by the DOJ.
It means a court is involved, but not a judge.

Edit

Even that is technically wrong; some DOJ subpoenas are apparently preauthorized by statute.

There's a pretty extensive list of administrative subpoena authority here:

https://www.justice.gov/archive/olp/rpt_to_congress.htm

tl;dr: Everyone from the Appalachian Regional Commission on down can subpoena you without a court being involved. And of course Congress has inherent subpoena powers.

Oh, this is so cool. Thank you!

This is a step towards answering my noodly question earlier in the thread: authorization for NDAs and "gag orders" in subpoenas appears to be controlled by (varying) statutes.

> The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possible.

Don’t lead with this.

> In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.

If you’re going to say this.

I’m not judging their decision. Maybe not going to prison is a greater concern to them. It’s fine to just say that you thought it was best to comply because [lawyer reasons that you don’t have to disclose to anyone]/counsel.

EDIT: Or say “there are bad people out there and we trust the DOJ”. Whatever.

Lighten up. Nobody's going to federal court to stop the DOJ from investigating botnets, carding rings, and ransomware scams, which is what these things are usually about. Nobody's mental model of PyPI was that they had Signal's priorities.
Then all the less reason to roll out the “of utmost importance” boilerplate. So what’s your point?

Also I don’t see how being light-hearted has anything to do with this submission, Thomas.

Its just they have no choice. And when they do the choose their "utmost priority". Its not that complicated
Then they shouldn't say protecting their users are their top priority, because they have shown it is not. That's called lying. A correct statement would have been "we will comply with lawful LEO requests"
Helping convict scammers, typo-squatters injecting malicious code, etc is protecting their users. Just not the (likely) bad actors that are the subject of the subpoenas.
The fact remains, that unless you are willing to break the law, obeying the law is your top priority.
If you're so inclined, you're welcome to make an anarcho-oriented package management system yourself. PyPi has never claimed to be one, though.
This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.
How have they shown it's not, exactly? Really curious what you think they could have done better aside from blatantly going against laws in their jurisdiction.
There's a difference between abiding by lawful court orders that have gone through judicial process and a friend in a police department calling in a favour.
(comment deleted)
It's a completely reasonable reading of their message to assume that the “possible” in “whenever possible” roughly means “legal”. I don't think any reasonable reading of it means to imply that they are willing to violate federal law.
Fair point.
Oke way to protect user data is to NOT ask/collect data in the first place. What's the need of person's full name and address for? Maybe I'm missing the point, but I see zero reasons to have this data in the first place.
You are probably reading what data the DoJ requested. Further down in the blogpost (in the "Details" section) they state that they don't have a lot of the data requested and exactly what kind of data they could and did provide. Addresses are not requested by PyPI.
And they state very clearly they don't have this information. In fact, PyPi seems to retain a very reasonable set of information, strictly related to the service itself. I found this disclosure to be entirely refreshing.
If you read the whole thing, it's pretty clear they don't have the person's full name and address, and thus did not provide it. They do mention that it will be needed for organizations that sign up for billing when that feature becomes available.

Other than possibly IP addresses, it seems like the only information they had available to disclose was close to the bare minimum needed to operate the service.

(comment deleted)
I don’t see anything conflicting in what they said.

They can feel that way, and comply.

Yeah. I was probably being a little too boilerplate (what looked like) -intolerant. ;)
By the number of malicious packages that site has hosted over the past few months, this was only a matter of time.

I've lost track of the number of "white hats" that contact us with extortion requests after they used some dependency confusion attack.

Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Would you rather them not report it to you or even worse, exploit it?
Sounds like they’re the ones who implemented the bad code in the first place, as a honeypot. That just extortion with extra steps.
> Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it?

Presumably because there is some demand for compensation before disclosure?

Pay me or I will harm you is extortion, as simple as that.

There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale.

They have no morals or security ethics, they barely even have knowledge, they just want to make money with the least amount of effort possible.

Don't ever pay them a cent. They're just as ruthless as spammers.

If several groups of people who "barely even have knowledge" can profit from checking for well known vulnerabilities on websites and reporting them I say more power to them.

If there is an entire industry of people doing low effort work which then discovers vulnerabilities on a company's website that company should pay them, and probably fire some people they've already been paying for not putting in even that much effort to secure their own stuff.

Who is less ethical? The people reporting vulnerabilities and wanting to be paid for it or the companies who don't bother to invest in even basic security practices putting people's data at risk and allowing scammers and hackers to leverage those insecure systems to hurt others?

The word "companies" is doing a lot of work in your rant.

The vast majority of websites on the internet do not have a team behind them. That's exactly the reason why they lack maintenance.

So they're not intimidating well-funded companies, they're intimidating that nice guy that in 2003 build a website for the local bridge club. Volunteering his time and money to do so.

> There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale.

If it's easy, then more the danger, and more the reason to pay the white hats instead of getting robbed by black hats?

Is it still "white hat" if money or a transaction is involved? My understanding is it's either black hat, the exploit is sold for money. Red team, you paid to be exploited for your own benefit. Or white hat, an exploit was found and it's communicated to limit black hat and red team. White hat + money would just be gray hat or blackmail.
White hats can still get bug-bounties. Though if a company hasn't published such a bounty and a hat 'extorts' the bounty by demanding payment or else they will publish, that hat has a tint of grey.
That's not a tint of gray, that's just plain black.
Why can't PyPI safeguard popular packages by making sure that new packages are few (4 or 5) edit-distance away to make sure popular ones don't get intermixed with malicious packages. Is that difficult to implement?
pip-env, pipe, pipes, sip, siv, lipo, etc Are all within an edit distance of 4 from pip, and would all be blocked.

Besides 'dependecy confusion' is not typo-squatting at all. It is about having a public package that masks the name of a private package repo. The default behavior of pip is to then use the public repo, which can let outsiders who know internal package names totally take over those internal packages.

That's certainly a way to look a gift horse in the mouth.
> We have waited for the string of subpoenas to subside, though we were committed from the beginning to write and publish this post as a matter of transparency, and as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023.

That's suspiciously specific. Sounds to me like they also received some other subpoenas they aren't allowed to talk about.

I think it just sounds like the three subpoenas they received
I'm not sure I'd call three subpoenas "a string of subpoenas" even if it's technically correct. But I'm more talking about specifically mentioning that the subpoenas from March and April 2023 don't have a gag order. Why mention those months specifically if in the other months they didn't receive any? The natural thing would have been to end the sentence six words earlier.
It sounds more like they're addressing the inevitable "why didn't you post as soon as it happened" party.
It is perfectly clear that you are correct because trying to tell anyone about confidential subpoenas could be illegal.
When it requires so much "reading between the lines" that even this community doesn't have a strong consensus on whether this is being (illegally) communicated or not, I think it's plausibly deniable, but IANAL. Contrast with well-known canaries.
Canaries that are well known would just become normal communication and thus illegal under a non-disclosure. It's just going to get worse lol.
> I'm not sure I'd call three subpoenas "a string of subpoenas" even if it's technically correct

I would if the sequence was such that the receipt of eachbof thr subsequebt ones delayed writeup of the overall incident in the interest of completeness or because there was some relationship between them

> the subpoenas from March and April 2023 don't have a gag order. Why mention those months specifically if in the other months they didn't receive any?

Because you are doing an aggregate writeup of a series of events and you want to convey when they occurred and why you are able to do a detailed writeup.

(comment deleted)
Yep, I was thinking the same thing. What a beautiful way of communicating that.
What a weird way to think about such events.

Such subpoenas are clandestine surveillance of citizens by their state. The problem with such types of surveillance in particular is the lack of accountability.

How does the ethical use of this prolematic tool get ascertained? Where and how is the democratic oversight implemented? How is misuse treated and prevented?

as a foreigner (in terms of the US), I've never understood how these gag orders are compatible with the First Amendment

often there's posts on HN about how the UK and all other Western European countries are totalitarian because they don't have unrestricted free speech

but then apparently the police (FBI) can restrict the free speech of Americans without any court involvement at all?

I really don't understand

Well, due process is a right co-equal to free speech, so which rights override which others in which circumstances will come down to legal precedent.

My understanding is that the FBI or other non-judicial body cannot unilaterally issue a gag order. Subpoenas and gag orders related to them are granted by judges.

(Which isn't to say that the relationship between the judicial branch and law enforcement bodies is always pure and equal)

Gag orders do require a court, just not a jury or an open hearing. I agree that they should be unconstitutional.
Look at this thread.

People engage in childish fantasies featuring themselves in imaginary subversive behavior.

It's unresolvable cognitive dissonance leading to repressing and reinterpreting the cause.

You seem to be misunderstanding the First Amendment. CSMA, classified information, defamation, copyright, etc. are all not permitted under the first amendment. Not to mention that gag orders are approved by a court and can be appealed.
> Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

seems pretty clear to me, at least for gag orders

less so for the other stuff you mentioned (could you argue pirated Disney movies are speech? probably not)

And the writers of the 1st Amendment went on to pass the Sedition act of 1798.

> That if any person shall write, print, utter. Or publish, or shall cause or procure to be written, printed, uttered or published, or shall knowingly and willingly assist or aid in writing, printing, uttering or publishing any false, scandalous and malicious writing or writings against the government of the United States, or either house of the Congress of the United States, or the President of the United States, with intent to defame the said government, or either house of the said Congress, or the said President, or to bring them. or either of them, into contempt or disrepute; or to excite against them, or either or any of them, the hatred of the good people of the United States, or to excite any unlawful combinations therein, for opposing or resisting any law of the United States, or any act of the President of the United States, done in pursuance of any such law, or of the powers in him vested by the constitution of the United States, or to resist, oppose, or defeat any such law or act, or to aid, encourage or abet any hostile designs of any foreign nation against the United States, their people or government, then such person, being thereof convicted before any court of the United States having jurisdiction thereof, shall be punished by a fine not exceeding two thousand dollars, and by imprisonment not exceeding two years.

Welcome to America. Our laws contradict each other and its all about politics. The Supreme Court figures out where the line is drawn and what is, or isn't, legal according to the Constitution.

With regards to 1st Amendment, the limit is drawn today at Libel, Slander, "Fire in a Crowded Theater", pornography, and many other restrictions upon "free speech". Gag orders included.

>"Fire in a Crowded Theater"

That one's apparently a myth.

https://reason.com/2022/10/27/yes-you-can-yell-fire-in-a-cro...

Libertarian website argues Libertarian viewpoints. News at 11.

I'm more inclined to believe Supreme Court Justice Alito over a Libertarian website. Especially because a sitting Supreme Court Justice literally will preside over the case and make a decision based on their own ethics/process/whatever.

An entire article that starts off with "BTW: Supreme Court Justice is wrong on subject" is... well... that's not how this works. The Supreme Court justice literally defines (or at least, is 1/9th of the definition) of our country's legal interpretation.

If the Supreme Court says "Obamacare is a tax", then its a tax. No if, and, or buts about it. It can be as ridiculous or contrived an argument they want, its the purview of the Supreme Court. They are the final say on any of these legal matters.

And unless "reason.com" (or any other libertarian source) somehow manages to get the ear of the other Supreme Court Justices to believe their argument, I think I can safely ignore their article there.

But they know that. I'm guessing they're just trying to clickbait readers and make somewhat sketchy arguments for more clicks + plant more articles that are aligned to libertarian values (as is the point of reason.com).

1. It was falsely shouting fire in a crowded theater, and it was not formative of the opinion itself (Schenck vs United States) but rather an aside.

2. Schenck vs United States was largely overturned by Brandenburg vs Ohio, but this aside was still non-jurisprudential.

3. I am unfamiliar with Justice Alito’s opinion on the matter and you didn’t cite it, so with no context I will only temporarily defer to you for the purpose of saying this: SCOTUS makes jurisprudence through the rulings and opinions they hand down when they take a majority vote in conference, draft opinions and sign on to them. One Justice does not make jurisprudence over a statement which itself was never jurisprudential.

Reason wears their ideological stripes on their sleeves, but this is still essentially a myth that doesn’t die and a fuller explanation of it isn’t a matter of ideology.

You still shouldn’t falsely shout fire in a crowded theater, as people will die. You also shouldn’t pretend a fire isn’t there or part of the show either as people will also die. Basically, if there’s a fire in a theater you’re in, just be glad for modern building and fire codes.

> 2. Schenck vs United States was largely overturned by Brandenburg vs Ohio, but this aside was still non-jurisprudential.

This here is the evolving nature of the court that I want to highlight most of all however.

In 1919, the Supreme Court believed one thing. Later, in 1969, half-a-century later, it believed another thing and overturned the earlier ruling.

As an organization, the Supreme Court tends to try to be consistent. But its not always true, and certainly in these days where we've had a dramatic change in the makeup of the court + filled it with young justices, we're going to see a big change in how the court writes opinions in the years, and decades, to come.

-----------

Laws are written. Constitutional Amendments are written. A few years ago, the 4th Amendment protected a woman's right to privacy and therefore Abortion. That's no longer true today. Etc. etc. Just a modern quickie example about how changing opinions can change our understanding of long-standing laws (or Constitutional Amendments) from the 1700s.

Generally speaking, the Supreme Court is trying to do what's right for our court system. To have laws interpreted consistently over time, and across the country.

The goal is to be consistent over time but it must also still maintain a reactionary posture to the cases brought before it. When there is a difference in opinion between earlier and later jurisprudence, later jurisprudence takes precedent and to be blunt, sometimes earlier courts get it wrong and later courts recognize this.

> A few years ago, the 4th Amendment protected a woman's right to privacy and therefore Abortion.

Due process clause of the 14th amendment actually was the citation under the portions of Roe v Wade not overturned by Planned Parenthood v Casey prior to them both being overturned in Dobbs. The due process clause is often used to read into law from the bench things which are not written into law by Congress or the States under the doctrine of substantive due process, and the issue with that doctrine comes down to: if Congress didn’t say it, and the States didn’t agree to it (Constitution), then is it really actually Federal law? So far the answer seems to be: temporarily yes, and on shaky ground until either Congress addresses it or a future court does. That a court can overturn its own precedents is why if we wish for them to stick, you write them into statute.

Going back to the First Amendment, most of the seeming contradictions in our free speech law really are addressed in the first 5 words of the First Amendment: “Congress shall make no law”. Courts are not Congress, and our Judiciaries have habits and traditions that predate the Constitution and are rooted specifically in the English common law, especially among the States which is why you can be found civilly liable for defamation in most States, and then the standard is high and the extent to which it is applicable is curtailed more with the First Amendment than it would be without it.

(comment deleted)
> Libertarian website argues Libertarian viewpoints. News at 11.

It's not just Reason or Libertarians saying that the old "fire in a crowded theater" trope is nonsense:

https://www.popehat.com/2012/09/19/three-generations-of-a-ha...

> An entire article that starts off with "BTW: Supreme Court Justice is wrong on subject" is... well... that's not how this works. The Supreme Court justice literally defines (or at least, is 1/9th of the definition) of our country's legal interpretation.

No, a majority of the current Supreme Court is what defines jurisprudence on a subject.

There are crazy (and non-crazy) minority opinions all the time that don't amount to anything. A later Supreme Court can even repudiate an earlier one.

So it's true that this could change someday, and maybe Alito would even be in the majority then, but until and unless that happens, the "fire in a crowded theater" example is still dicta from an old case that's not good law.

surely that Act is by definition unlawful?

I still don't really understand

in the UK: Parliament has unlimited power and people talk quite a bit about formal constitutions being a good model to be followed

it seems a bit sad the attempt to protect the population against government using a formal constitution doesn't seem to work in reality (even when the wording is as clear as day)

> surely that Act is by definition unlawful?

Whose definition?

Answer: The Supreme Court decides the definition of things. Its only unconstitutional if the Supreme Court says so.

That's how the USA can get away with... I dunno... the Office of Censorship in 1941. (https://en.wikipedia.org/wiki/Office_of_Censorship). Definitions change, not only due to different members on the Supreme Court, but also due to different circumstances (WW2 meant that the Supreme Court was willing to ignore the obvious incursion into the 1st Amendment, at least temporarily)

EDIT: I always forget that it was actually the Office of War Information that did the Hollywood Censorship thing (https://en.wikipedia.org/wiki/United_States_Office_of_War_In...), rather than the Office of Censorship.

> Whose definition?

I guess that's the underlying problem

I'm not sure how you fix it really, though not having direct political appointees as top judges might be a good start

(maybe put an LLM in charge of a supreme court? I kid, I kid)

You do have a King though. What would happen if the PM went to see him to form a government and they disagreed? The King is the one with armed guards, military rank and a fortress.
As part of his coronation, the King has sworn an oath to uphold the Law and to respect the primacy of Parliament. Not appointing the PM and his government has serious consequences as the PM is the leader of Parliament, which is the institution that has actually restored monarchy after the Glorious Revolution and which actually bankrolls the armed forces, and which was ultimately elected according to the Law by the citizens.
The king is the de facto ruler, to say otherwise is being pedantic.
No, this is pedantic::

De facto means in fact. Given that the king does no governing no, he is not, in fact, the ruler. You may be looking for de jure, though I question even that.

The king of the UK still has to respect the Law. Being king does not mean that one can do as one pleased, or that there are no checks and balances. The last English king who tried to become an absolute ruler caused the English Civil War and was put on the chopping block by Parliament, as a matter of fact.
No, he's the ceremonial head of state. There's a polite fiction that all power comes from him, but he can't actually make anyone do anything.

If he tried, people would say no. If he insisted, he'd get tossed out on his ear.

> With regards to 1st Amendment, the limit is drawn today at [...] "Fire in a Crowded Theater"

No, and it never was. That was an obiter dictum that didn’t accurately reflect the state of the law in the decision in which it appeared, and the actual holding in that case itself (now regarded as an intense intrusion on core political speech) is no longer operative.

It's a catchy turn of phrase that gets stuck in the mind, but it was also an rhetorical device neither in a decision that has since been substantively overruled, not an actual example of an existing limit on free speech.

Well, if that particular phrase is poisoned, I guess I could just say "Hobbit" instead, which is owned as a trademark IIRC by the Tolkien estate and they're very litigious about it.

You can't say "Hobbit" in your own stories. But you can say "Halfling", and that's how people tend to get around that problem. Blonde Thor is Disney/Marvel (Historical Thor was a redhead IIRC, so Blonde Thor is Disney/Marvel Trademark), etc. etc. Plenty of restrictions on Free Speech in practice.

> You can't say "Hobbit" in your own stories

You can, though.

You can't use it to market your stories or other products, and there's some manners of use innthr body of a book that might run some risk of liability for dilution or tarnishment, but...

Of course you can. You can write about hobbits, make youtube videos discussing them, whatever. There's a lot of fanfic on hobbits out there. You can make fun of hobbits.

If you want to use copyrighted characters and it's not fair use, then no.

In the constitutions of many other countries, you will find an explicit clause saying (to effect) "rights and freedoms granted by this constitution are not absolute and exceptions can be made to them for sufficiently grave reasons".

Unlike those other countries, the US Constitution never contained such an explicit clause, but the Supreme Court has always read it as if it did. The Supreme Court feels quite justified in doing that, because if you go back and look at the debates in Congress and the state legislatures over the proposal and ratification of the Bill of Rights, it is clear that its proponents always intended it to be interpreted as if such an "exception clause" existed, even though (for whatever reason) they chose to leave it as implicit rather than explicitly putting it in the text.

The first amendment must be a lot longer than I thought.
Copyright is something the first amendmend explicitly carves out exactly because it is incompatible with free speech.
(comment deleted)
the fbi is overseen by elected officials, and by laws that were voted for it. it's not perfect but that still makes a huge difference.
That explains the whole Trump Russia ties investigation by the FBI I guess?

Doesn't seem to healthy for any nation that is supposedly democratic?

Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc. Private entities such as your employer can restrict your speech in many ways.

> often there's posts on HN about how the UK and all other Western European countries are totalitarian because they don't have unrestricted free speech

I haven't seen these posts. Do you have an example handy?

> I haven't seen these posts. Do you have an example handy?

here's one from earlier in the week: https://news.ycombinator.com/item?id=36000459

they're pretty common, here's another one: https://news.ycombinator.com/item?id=35617773

In the GGP you wrote,

> often there's posts on HN about how the UK and all other Western European countries are totalitarian because they don't have unrestricted free speech

I don't see that in the comments you cite - nothing related to totaliterianism, unrestricted free speech, or comparison to the US. The comments just look like critiques of some laws related to speech, similar to critiques of US laws. Maybe I misunderstand.

funnily enough, the USA has much less protective laws against self incrimination than e.g. Denmark. In Denmark, you, as charged, may lie on the stand however much you please.
In the US you just have to shut up. It also saves you from getting caught in a lie.
The astonishing amount of people incarcerated without a process tells a different story.
How many are incarcerated without a process?
I'm not the GP, but here are some ways:

Something like 95% of criminal cases are resolved with plea deals and not trials, and legal representation from public defenders has very limited resources.

Cash bail results in many people imprisoned without trial: After arrest, the court requires bail. Poor people can't afford it, so they are jailed until trial, which can be over a year. The impacts go beyond the (very serious) loss of freedom: They lose jobs, their family loses income, dependents (children, elderly) lose caregivers.

Firstly, though I see the concept behind cash bail I don't agree with it. But people has a misconception of the likely result of removing it.

Judges now, don't need or required to use cash bails, they choose to, they can release people without cash bail now. either into the person's own recognizance, or even into the care of others.

If a judge doesn't feel the person is likely to return to their following court date, and they can't leverage financial burden as a means to insure it, they are likely just to forego the process and hold them.

In California "at least 1,317 people have been waiting in county jails for more than 3 years. For 332 of them, it’s been longer than 5 years."

Source: https://calmatters.org/justice/2021/03/waiting-for-justice/

Both the California and US constitutions guarantee a right to a speedy trial, and California criminal code has specific provisions on how quickly trials must begin. Who is holding the California government responsible for this? What an outrage.
Wowzer, right. That is...pretty compelling. And incredibly illegal. Does California not know it doesn't have a right to just incarcerate people for no official reason?
Or say "I don't recall". That's a popular one with politicians.
Shutting up and refusing to answer a question makes it very clear that you have something to hide, much more than a lie.

I'm not sure whether that's good or bad. I guess it depends on what you are accused of.

Is it actually? I've often heard the advice from the US lawyers to answer no questions.
That’s not the case.

If you choose to plead the fifth, the prosecution is absolutely forbidden from bringing that up the courtroom, much less using it to insinuate your guilt.

Any lawyer in the US will tell you not to speak to the police or prosecutor. At all.

Not true. In the Kyle Rittenhouse case, despite being nationally televised to millions, the prosecutor questioned why he didn't answer questions post arrest
And the judge immediately halted the trial, reamed out the lawyer as being unimaginably unprofessional, and threatened that he might toss the whole case if the prosecutor ever insinuated something like that again.
yes, and there is a high chance that with either a less vigilant judge, or a less caring defence (see: public defender), it would not have been stopped.

The point is: this case was televised to millions and he STILL questioned it.

The point is that the DA in that case was incredibly unprofessional across the board, and this was just one of many bad decisions he made.
> Shutting up and refusing to answer a question makes it very clear that you have something to hide

It really doesn't, at least in a court of law. Although if the police are interrogating you, they will almost certainly try to convince you that it does.

(obligatory IANAL disclaimer)

I don't think you're ever required to any answer any questions from the police, whether avoiding self-incrimination or otherwise. You're only required to answer a question in court, and even then only if the answer wouldn't be self-incriminating (or a few other narrow exceptions I think; the concept of the court not being allowed to compel someone to testify against their spouse is a common trope in media, although I'm honestly not certain how accurate it's portrayed). You also aren't required to take the stand when accused of a crime; while you can choose to do so, you're also free to just have your lawyer make your case via the questioning of witnesses instead of having to answer questions directly yourself.

That said, my understanding is that you're _not_ allowed to plead the 5th if the answer wouldn't actually be self-incriminating, so it's a weird thing where you're only allowed to not answer a question by essentially stipulating that you _did_ do something illegal that would be disclosed if you answered truthfully. If they can prove you weren't actually avoiding answering due to self-incrimination but plead the 5th anyways, I'm pretty sure you can be charged with contempt of court. Having never been on a criminal jury, I can't say I know exactly how it would play out in deliberations, but it's hard for me to imagine that it doesn't affect things at all; even if a jury isn't technically allowed to consider it an admission of guilt, from a legal perspective pleading the 5th seems pretty explicitly either a non-legally-admissible admission of guilt or a crime of contempt of court in itself, so I don't see how the law isn't basically forcing the jury to conclude that you've committed a crime one way or another. The question would then boil down to which of the two crimes the jury thought you had committed (the one you were accused of or contempt of court), and while they're not supposed to be deciding the question of the latter, it seems likely that the jury's view will be tainted by this.

Of course, all of this only applies if you did actually commit a crime; if you genuinely didn't commit any crimes, you wouldn't be lying under oath when stating that instead of pleading the 5th. The jury still might think you did commit the crime though and are just doubling down on lying under oath to try to hide that, though.

Only in your own defense or in defense of your closest loved ones, I believe. If it's like in Norway.
Then following up on blibble's question: What is the difference to the UK and other western countries that mostly also have free speech with what looks to me very similar restrictions?

Honest question, like blibble, I don't really understand it either?

The US's first amendment is rather unique amongst Western nations. Basically it says "the government cannot infringe on this inalienable right", that is the government cannot govern speech. Here's the actual language

    Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
The key phrase "or abridging the freedom of speech, or of the press".

As far as I know, this kind of language is absent from other Western nations. For example, Canada jails people for criticizing those of Islamic persuasion. [0] Note, the article doesn't record what the accused actually said. Here's a wikipedia overview of hate speech laws by country [1], though it is wikipedia, so take it with a grain of salt. Here's a somewhat relevant piece from Reason that takes an anti-hate-speech stance [2] where the author details the unconstitutionality of hate speech laws.

"Free speech" as we understand it in the US is unique in the world.

As far as the restrictions at state and federal level, these are considered unconstitutional, and you'll see a large number of them struck down in various courts across the country. Those in power definitely seek to expand their powers and fortunately we have a law that allows the citizenry to push back against that.

[0] https://www.cbc.ca/news/canada/hamilton/muslim-hate-1.614516...

[1] https://en.wikipedia.org/wiki/Hate_speech_laws_by_country

[2] https://reason.com/2021/05/20/teen-arrested-under-connecticu...

Hm, not quite sure I can follow the _unique_ part.

E.g. german constitution is quite similar:

``` Article 5 [Freedom of expression, arts and sciences]

(1) Every person shall have the right freely to express and disseminate his opinions in speech, writing and pictures and to inform himself without hindrance from generally accessible sources. Freedom of the press and freedom of reporting by means of broadcasts and films shall be guaranteed. There shall be no censorship.

(2) These rights shall find their limits in the provisions of general laws, in provisions for the protection of young persons and in the right to personal honour.

(3) Arts and sciences, research and teaching shall be free. The freedom of teaching shall not release any person from allegiance to the constitution. ```

(2) notes that there _are_ limits, but if I understood the concept of gag orders and also wolverine876's answer correct, thats the same for the US:

``` Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, ```

I was under the impression that Germany bans Nazi symbols (with some exceptions for education/art). [1]

In comparison, Nazi symbols are protected hate speech in the US. [2]

The US has tried to ban political parties in the past but eventually courts find that sort of thing unconstitutional. [3]

[1] https://en.wikipedia.org/wiki/Strafgesetzbuch_section_86a

[2] https://en.wikipedia.org/wiki/Bans_on_Nazi_symbols#United_St...

[3] https://en.wikipedia.org/wiki/Communist_Control_Act_of_1954

In Germany Nazi symbols are strictly banned but you are allowed to name soldiers killers. My hunch is that calling a veteran or active member of the armed forces of the US a killer would not go so well and might very well end in a slander suit.

When you free speech is restricted still seems pretty arbitrary to me [shrug].

You can call US service members killers all you want. In fact "baby killer" is a relatively common refrain during protests aimed at the military. Maybe in the UK with their asinine slander laws you'd have to be more quiet but that's pretty clearly first amendment protected territory in the US.
SLAPP suits are a thing in the US. You might not go to prison for your speech but that doesn’t mean you can do it.
SLAPP suits come from massive sources of capital which have enough counsel either on retainer or simply have enough money that they don't miss ~$50k on a whim to get back at someone who they think besmirched them that one time. That doesn't really apply to US service members.
SLAPP suits are filed by the defendant, ie the person who said the thing.

They're a response to being sued. If a lawsuit is clearly bogus, you can get it thrown out extremely quickly and the other side usually has to pay your attorneys.

Not all states have them and not all states that have them, have good ones.

https://anti-slapp.org/your-states-free-speech-protection

> Strategic lawsuits against public participation, or strategic litigation against public participation, are lawsuits intended to censor, intimidate, and silence critics by burdening them with the cost of a legal defense until they abandon their criticism or opposition.

Anti-SLAPP suits are filed by the person who said the thing. And yes some states have good anti-slapp protections but that means the rest of Americans don’t enjoy that freedom.

You could get sued, but you would almost certainly win, as evidenced by the Westboro Baptist Church who won a Supreme Court case after being sued for witnessing their Christian faith with messages like "Thank God for Dead Soldiers" and "You Are Going to Hell" at a soldier's funeral:

https://en.wikipedia.org/wiki/Snyder_v._Phelps

> The US's first amendment is rather unique amongst Western nations.

> As far as I know, this kind of language is absent from other Western nations. For example, Canada jails people for criticizing those of Islamic persuasion.

The US is not unique in having constitutional protections of free speech. For example part of the Canadian constitution is the "Canadian Charter of Rights and Freedoms", which forms part of the Constitution Act 1982. Section 2 of which says "Everyone has the following fundamental freedoms: (a) freedom of conscience and religion; (b) freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication;" – that's essentially saying the same thing as the US First Amendment.

In Europe, article 9 of the European Convention on Human Rights (ECHR) protects "Freedom of thought, conscience and religion". The Convention is quasi-constitutional in nature – while it is an international treaty whose members are in theory free to leave at any time, in practice quitting it is impossible for many European countries–membership in the ECHR is a requirement for EU membership, so no EU country is going to get away with denouncing it. And many national constitutions have equivalent provisions, such as articles 4 and 5 of the Basic Law of Germany.

One difference – the text of the US constitution doesn't contain any exceptions to the 1st Amendment, whereas the Canadian constitution, the ECHR, Germany's Basic Law, etc, explicitly state that freedom of speech/etc can be subject to limitations. However, in practice, even though the US constitution never explicitly says that the 1st Amendment has exceptions, the Supreme Court has always held that it does, although the scope of these exceptions has varied due to the evolving opinions of the Supreme Court – for the first century of the US's existence, SCOTUS allowed sweeping exceptions to the 1st Amendment; in the 20th century, it narrowed the allowed exceptions significantly, and developed some highly complex case law on which exceptions are allowed.

The real difference is actually nothing to do with the text itself, it is all about case law – since the 20th century, SCOTUS has been very strict in only allowing quite limited exceptions to the 1st Amendment. Courts in Canada, Europe, etc, have always been much more liberal in allowing exceptions to the right of free speech. Now, possibly the difference between a text which provides no explicit exceptions versus a text which does may have influenced that, but I don't think it was decisive. It was not historically inevitable that SCOTUS would start interpreting the 1st Amendment much more strictly in the 20th century, if different justices had been appointed, it easily could have decided to stick with its 19th century case law which allowed greater exceptions to it. Conversely, even though Canadian/European/etc texts explicitly mention exceptions, their courts could have chosen to interpret those explicit exceptions far more narrowly, producing a result much closer to that of the US, if they had wished to do so.

Canada does a lot of things better than the US, but not free speech.

Canadian law on is nowhere near as protective as the US. Defamation has a much lower standard there.

Defamation with public figures in the US is next to impossible to win. That's not true in Canada.

Similarly, in Australia it is generally much easier to win a defamation case than in the US.

However, there is one interesting difference – under Australia's uniform national defamation law (adopted in 2005), corporations cannot sue for defamation. (There is an exception for small businesses, with less than 10 employees.) So, the recent Dominion vs Fox News lawsuit would have been impossible in Australia.

Could it be possible to illustrate with an example just for clarity? How does this compare to, say, the Netherlands? For example what are things that are possible in the United States that are not possible in the Netherlands? I would assume there are things that are not legal but not penalised in the latter but under certain conditions would be addressed and penalised and there's no way around it, but would like to know of an example just to make it super clear for me. Thanks!
In the US it is legal to advocate hate, such as denying Holocaust or promoting National Socialism or white supremacy. The courts have repeatedly struck down bans on hate speech. Not sure about the Netherlands, but this is illegal in many European countries.
Radiolab has a great episode about how this more broad application of the first amendment sort of came about due to Oliver Wendell Holmes changing his mind about what actually constitutes a "clear and present danger" between two Supreme Court cases in 1919.

https://radiolab.org/podcast/what-holmes

Idk the US specifics but hate speech in Spain is something govt has used to prosecute others in the name of so many things and in so many situations that to me, it means nothing. Just having a negative opinion is "hate speech" if the right person gets annoyed and goes for you.

It is a very powerful tool to shut up adversaries and it is extremely harmful for real opinions and real free speech.

If you're itching to speak freely, we'd love to have you in the US. :D
Why is denying or promoting something considered hate? Where is the list of things we are allowed to deny or approve of?
Because denying a group of people (say, based on ethnicity or skin color) the right to exist is equivalent to hating them.
Take a person who believes that "there needs to be a country for white people and white people are innately better able to form productive societies". This person would clearly be a white nationalist and a white supremacist, right?

But they may also have no hate towards other ethnicities or desire their deaths. If pressed, they might even say that their vision of a "pure" society isn't worth the deaths of minorities that would come about if they tried to implement it.

I think too often we confuse the stereotypical example with the definition. The stereotypical white supremacist hates minorities, but the definition itself doesn't require it (I know of no surveys that would tell us what proportion of white supremacists match the stereotype).

You can't be a white supremacist without thinking other races are inferior. That's hateful by definition. They are stereotyping an entire race in a negative manner. They are denying the basic humanity of billions for what end? The Third Reich didn't immediately start throwing Jewish people into death chambers. They had to build up to that moment by dehumanizing their victims.
> That's hateful by definition.

My whole point is that you (and many others) are using a new definition of "hate" which doesn't match the old one. "Hate" used to be an emotion, a feeling, a dislike of something and a wish to see it destroyed.

One can feel superior to something without having any dislike of it or a wish to see it destroyed. I consider myself superior in many respects to the rocks in my back garden, but I neither dislike them nor wish them destroyed.

A supremacist may consider themselves smarter or prettier or taller than some other group, but that does not necessarily mean they want to destroy the other group.

I kind of get your point (i think?) but maybe you shouldn't try to belittle the use of the word "supremacists" in the context of modern language. Try looking up a definition if you are unsure. Maybe you disagree on the definition but that is probably the mainstream one...
At your prompting I've tried to look up a definition, but there doesn't seem to be a commonly accepted one... merely usage where the scope of the terms varies from one source to another.
That is simple.

Any left-wing should be allowed, any right-wing stuff should be denied.

Few exceptions exist on the western side, Spain is probably the most remarkable case. Reason why you wouldn't often hear much about what happens there, unless it is something negative to bash the right-wing people there.

Note that including denying the Holocaust under "advocating hate" is basically making up a new concept and using an existing word (hate) for that concept.

It comes across as very dishonest.

There are people who genuinely think the Holocaust was exaggerated or didn't happen at any substantial scale who bear no ill will to Jews, seeing it simply as a question of historical fact of limited relevance to the modern day.

Denying that a targeted genocide happened or saying it's exaggerated is absolutely hateful. I'm not sure how it's of limited relevance when it's within living memory. When (some) Americans start to chant "The Jews will not replace us!" I think it's very relevant to our modern era.

I would really recommend doing a cursory, bare-minimum reading of the associated Wikipedia page [0] and citations. Plenty of historians revise the events surrounding the Holocaust to provide less biased and more nuanced information. Very different from taking an assumption as fact (the holocaust did not happen) and working backwards from that.

[0] https://en.wikipedia.org/wiki/Holocaust_denial

I think, as ever with these things, the name is misleading. It's not "hate". We've no idea what people are feeling. Why do we a) think someone feeling "hate" is enough to suspend speech, and b) think if we want to justify censorship, we can't just say it out loud?

Why not just say "we ban speech that says the Holocaust didn't happen"? Why get it classified as hate and then because somehow hate is censorable get it autocensored? It seems somehow disingenuous.

Because there's no rational or non-ideological way to deny the holocaust. The evidence is literally overwhelming.

The only reason people deny it is because of anti-semitism.

Of course there is. People might be ignorant. If a kid is just taught that the Holocaust was made up, no hate is required for them to believe it. People need to stop pretending they can divine people's emotions. What matters is their actions.
No, some haven't seen the evidence or think it's fake.
You're missing my point.

What does the word "hateful" mean? The old meaning is "full of the emotion of hate". Someone who thinks the Holocaust wasn't real could in theory have no strong feelings about it and think it has no relevance to their lives.

It is not required by definition that Holocaust denial is hateful (using traditional definition of the word "hate"). Nor is it required by human psychology (for example, you could have someone who read an unfortunate sampling of books as a child and took "disbelieve anything the victors of a war say about their enemies" as gospel and never got educated on the details).

It's a useful label to categorize and marginalize speech. This is a common tactic used in propaganda.
My goodness. That raises questions. I hope you are merely naive.

"I don't hate them! I just think they got a bit worked up over a few arrests. They're too sensitive. I don't blame them for it, but when you deal with them you've got to remember they can be prone to distorting the truth."

Come _on_

Uh, I have no idea what you're saying here. Particularly can't see any relationship between what you quote and my post.
(comment deleted)
A politician in the Netherlands got a crowd chanting "Do you want more or fewer Moroccans?" "Fewer! Fewer! Fewer!" [0].

A court found him guilty for "groepsbelediging", insulting a part of society, which is a crime. He did not get a punishment.

That's the only example that comes to my mind of something that the courts found not allowed in the Netherlands.

[0]: https://www.youtube.com/watch?v=BaB75uznT8o

It seems kinda arbitrary

Earlier it was listed "..you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information.."

So where are these exceptions innumerated? Just purely from a technical point of view, why can defrauding be made illegal, but hate speech can not?

It actually seems the number of exceptions is quite limited - so I never understood why they were not spelled out explicitly (like in an subsequent constitutional amendment for instance). It seems to undermine the authority of the bill of rights. The original text makes no provision for exceptions...

The specifics have been determined in case law. I'm not a lawyer, so I can't give a more detailed example. I can, however, give some examples (Mass Media Law at Utah State comes bubbling back into my mind, what a fun class).

Yelling "fire" in a crowded theater, for example [0]. Another comment in this thread talks about the "clear and present danger" doctrine that came from the case. That case was followed by the Brandenburg v. Ohio [2] case in 1969, which instituted the current methodology used for determining what is "allowed" speech. That rule/methodology is called the "imminent lawless action" rule.

[0] https://supreme.justia.com/cases/federal/us/249/47/

[1] https://en.wikipedia.org/wiki/Shouting_fire_in_a_crowded_the...

[2] https://supreme.justia.com/cases/federal/us/395/444/

Yeah, I'm not a lawyer but the system seems honestly nonsensical. They found the law inconvenient, so the court just effectively added a "clear and present danger" clause to the law. If there were problems with people abusing their freedom of speech, then you'd think the natural response would be to amended the bill of rights - and not just a bunch of unelected judges dreaming up something that seems "reasonable"
I honestly can't speak to "reasonable", but this format of jurisprudence has been common for the better part of 4000 years (see Jewish law and case law that pops up in the Bible's old testament, especially the tanach).
Case law doesn’t exist in the United States of America. You might be thinking about medieval England, or ancient Persia, where a king or judge’s word becomes law. In the USA, people are judged individually and are equal before the law. One exception, that is traditional, but not enumerated in law, is that the Supreme Court can strike down a law that it deems unconstitutional, but may not amend or make new laws itself. Lower courts havee Ed no such power.
That's completely wrong.

First, every court of appeal can strike down a law as unconstitutional. The Supreme Court is only special in that there is no further appeal.

Second, case law absolutely determines the interpretation of each text, and each court is mildly bound by its own precendent (via stare decisis), and completely bound by the precedent of superior courts.

Third, there is no tension between these facts and people being judged individually and being equal before the law. The law must (in principle) be applied equally to everyone.

> First, every court of appeal can strike down a law as unconstitutional.

Any federal court, not just the courts of appeal.

Mostly right, but [0] is out-of-date, was overturned, and is a zombie free speech trope that is resistant to any headshot ever tried: https://www.theatlantic.com/ideas/archive/2019/08/free-speec...
I find the debunkers of this myth to be overzealous, or at least confusing.

You can be charged with a crime if you knowingly, falsely yell "fire!" in a crowded theater and someone gets hurt as a result.

The case you linked is not actually a ruling on whether you can do this.

The biggest problem with the trope is that it plants in people's heads the idea that there was EVER a Supreme Court case where the defendant was accused of yelling "fire!" in a crowded theater.

In reality, the phrase was an analogy used to justify the conviction of a man who committed the heinous crime of… making and distributing leaflets opposing the draft in World War I. So for all the high minded rhetoric in the First Amendment, it may not provide all that much protection if your speech inconveniences the government sufficiently.

One might also be tempted to draw inferences from the fact that Schenk, the man whose speech was considered not worth protecting, was a socialist pacifist, while Brandenburg, whose free speech was considered more worthy of protection, was a KKK leader promoting violence against Blacks and Jews. In the US, protecting the civil rights of Nazis has become a litmus test of civic virtue across the political spectrum. Unfortunately, that protection is extended far less vigorously and consistently to other political views.

https://en.wikipedia.org/wiki/Schenck_v._United_States

https://en.wikipedia.org/wiki/Brandenburg_v._Ohio

https://en.wikipedia.org/wiki/National_Socialist_Party_of_Am...

Hmm it sure sounds like "government abridging the freedom of speech of individuals" to me
It’s not strictly about the words in those exceptions.

In the case of fraud, it’s not the speech itself, it’s the part where someone gives you money (or other consideration) under some agreement or understanding, and doesn’t actually get what was promised. There’s nothing intrinsically wrong with what you promised, it’s your failure to deliver.

Threatening people? The illegal part is not that you used words at them specifically, it’s that you caused them to credibly fear for their life and safety. You could just as well do that without words, just standing outside their place with a baseball bat making menacing gestures. Harassment similarly may use words, but the objectionable part is often subjecting them to your words or actions or presence directly, to cause distress, instead of leaving them alone in peace.

“Hate speech” as a problem generally is about the content of the speech itself. You might wish to convince people that others in a group are bad and worthy of being considered bad. Your audience is typically people like yourself, or third parties who you wish to sway, and if you are in a public place you are mostly not following around an individual to be hated, or telling them you are about to do them violence. (If you do, it may in fact be harassment or intimidation.)

Given that some things that don't use words—for instance, art, money—have been ruled as being considered equivalent to speech for the purposes of First Amendment protections, I don't think the rationale you give there is likely to be the one used to justify the listed exceptions to the First Amendment.

In all the cases listed, the speech in question is being used to directly and (at least usually) intentionally harm or interfere with another person. I believe this is a case where looking to the Framers' intent rather than the strict wording of the amendment is worthwhile in determining how best to apply it. It seems obvious that they did not intend to make all forms of fraud and threats legal with no recourse (and I imagine there is some jurisprudence that cites specifics to this effect).

This is what the article says for [0]

“Police say the man targeted people on social media and promoted hatred against them after an attack in London, Ont., in June, where four members of a family were killed.”

Does that sound like criticism to you? It reads like harassment to me.

I don't know what the man said, only what the authorities reported. This is part of the danger of "hate speech" laws; if speech is deemed dangerous, discourse can be hidden behind public safety concerns and then wholly dismissed. It is then left to those who police speech to determine what is acceptable public discourse and what is not.
Wow, American exceptionalism claims have now gone so farad to claim that freedom of speech is unique to America!

Not even the historical claim holds, as constitutional protections for free speech in France and Sweden predate the American constitution.

> For example, Canada jails people for criticizing those of Islamic persuasion

He was arrested, presented to court, and acquited. Therefore he was not "jailed". Also: the charge was inciting/organising a hate crime, in the wake of a killing of a Muslim father and his 15-year old daughter, not "criticising those of Islamic persuasion".

Don't be a liar, it doesn't help your argument.

> Also: the charge was inciting/organising a hate crime

True, but we don't know what the man actually said. So whether the charge was true or not remains solely decided by those policing speech.

> He was arrested, presented to court, and acquited.

Thank you for pointing this out. I should have been more careful in my reading of the source material.

Rather than posting a poorly-worded, short-on-facts news story about the guy in Hamilton saying some hate speech, you could cite the actual Canadian Criminal Code which is far more specific and worthy of discussion: https://www.criminal-code.ca/criminal-code-of-canada-section...

This is what the guy was charged with violating (as per https://hamiltonpolice.on.ca/news/hamilton-police-charge-mal... )

Framing it as "Canada jails people for criticizing those of Islamic persuasion" is disingenuous, as if Canada specifically has laws about some specific religion or faith.

Without knowing what was actually said that the courts deemed to be promoting hatred, "Canada jails people for criticizing those of Islamic persuasion" is a valid interpretation. Citing vague laws doesn't make this any more reasonable.
IMO the worthwhile fact to share on an HN thread is "in Canada there are specific laws against inciting hatred through speech etc." and linking that criminal code entry, rather than mentioning and linking a specific news case that we have no real details on. At least the criminal code is a clearly-defined thing we can learn from and internalize, rather than a specific case where the public was not given enough information to make an informed judgement about (as per most news stories, IMO).
Both are important really - the law and how it is interpreted by the courts. That we don't know the details of the case doesn't make it less concerning - on the contrary, media not reporting the relevant facts (in this case, what exactly was said/done) only makes this more concerning. Especially if the lack of reporting is due to fear of running foul of the same censorship laws.
In New Zealand where we don't have a specific constitution or amendments we have a set a laws ^1 that end up in the same place. An example is libel, which both countries have laws against. In NZ such laws are debated in parliament and voted on just as in the US. However in the US there was an additional objection based on it violating the first amendment but then the law was made anyway so it seems politicians in the US can make laws that override amendments in specific situations. The US also has their Supreme Court which seems to play a far more active role than NZ's and also more powerful in that it can creates precedents in the interpretation of laws for example allowing students to wear items of symbolic protest in school.

^1 In 1990 we got a law called the Bill of Rights Act which included freedom of expression.

Edit: added ^1

A ready example: though it is clearly not appropriate to do so, in the US you can express Nazi-isms that are verboten or illegal in parts of Europe.
The UK is especially bad because of its very restrictive libel laws, since it puts the burden of proof on the defendant.
> interfere with others' activities (sing loudly in a movie theater)

This is more about private property rights, is it not? You can sing loudly in a park until local ordinances (noise, curfew) kick in.

The "movie theater" example I'm familiar with is that you can't scream "fire" in a crowded place.

you absolutely can sing loudly in a theater, but you don't have a right to demand you can keep on doing it. It's a private location, so they have every right to throw you out and ban you. similarly to how you don't have a right to say whatever you want without being moderated on Twitter or Reddit.

the fire one is basically anything that incites panic can get you into legal hot water, and if there are injuries or death as a result some form of manslaughter charges probably because ultimately you were responsible.

> you absolutely can sing loudly in a theater, but you don't have a right to demand you can keep on doing it.

good point

(comment deleted)
It appears absolute to me if you sharpen the definition.

Free speech means you can express and advocate for any view point, not that you can make any sounds with your mouth in any context.

You cannot express or advocate viewpoints that "harass people (beyond a some limits), threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc."

For example, someone could not express the viewpoint that 'thebigwinning sexually assaulted coworkers and stole money at their last job'. It would slander you (an exception to free speech that I omitted in the GP) and you would be entitled to damages.

Nor could someone express to an angry crowd the viewpoint that 'the bigwinning should be assaulted', nor could someone selling cryptocurrency express the viewpoint that 'cryptocurrency is a safe, stable investment for unsophisticated investors', etc.

That's exactly what I'm not saying. These contrived examples only strengthen my view.

> sing loadly in a movie theatre.

Perfect example. Inappropriately making sounds with your mouth, not holding an illegal belief.

> express to an angry crowd the viewpoint

The issue is the context of the angry crowd, not the content of beliefs. Do you believe the US will penalize me for believing crypto currency is safe and stating that publically?

> thebigwinning sexually assaulted coworkers and stole money at their last job'

They are indeed allowed to believe that. They can't be taken to jail for holding that view of me. Now if they tried to get me fired with false evidence that would be a problem. If they caused damage to my business reputation without evidence that could result in civil damages.

The examples are not contrived, they are commonplace legal issues (though any such issue is rare in any one person's life).

We are talking about speech, not thought - expression, not belief. You said "you can express and advocate for any view point", not that 'you can believe any viewpoint'.

Yes, all speech depends on context. The significance of speech is its impact on other people; it is communication. You can say whatever you want in the shower.

You are not engaging with my point and continuing to converse with the one in your head. Goodbye.
Summarised as "rights [...] are not absolute", this is a really weird statement. I confess I don't understand what makes a "civil right" different from an actual "right", to you.
>Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc. Private entities such as your employer can restrict your speech in many ways.

So the First Amendment is basically just the demo. And other western countries, oft criticized, just didn't have as nice a demo as that, but offer more or less the same features and gameplay.

That's only true if you have a very surface level understand of law and how it attempts to solve real-world problems.

It's nice to say "all speech should be free!" in theory but then, when faced with a situation where a mob boss says "please go kill that person" or ringleader whips up a mob into a riot. Should a judge just say "well, he was just exercising his First Amendment rights!" and ensure no consequences befall that person?

A person enters my home and says things I find offensive. Should the First Amendment prevent me from removing that person from my home for that reason?

I decide to leak trade secrets of my employer for profit. Should the First Amendment protect me from being fired and sued for this?

I thought that the First Amendment was about not allowing government to restrict speech and doesn't cover private issues such as between individuals or between an employer and an employee?

With the mob boss example, wouldn't the charge be something like conspiracy to commit murder rather than prosecuting the instruction itself? i.e. saying the words is not in itself illegal, but the intention to conspire to get the person to commit crime on your behalf is the illegal part and the instruction is evidence.

> I thought that the First Amendment was about not allowing government to restrict speech and doesn't cover private issues such as between individuals or between an employer and an employee?

Absolutely, it is. However, I interpreted the comment I replied to as suggesting the First Amendment is not sufficient free speech protection.

>when faced with a situation where a mob boss says "please go kill that person" or ringleader whips up a mob into a riot. Should a judge just say "well, he was just exercising his First Amendment rights!" and ensure no consequences befall that person?

Isn't that covered by actual murder (or conspiracy to commit murder if it isn't seen through) charges, unrelated to free speech?

>A person enters my home and says things I find offensive. Should the First Amendment prevent me from removing that person from my home for that reason?

Isn't that covered by the right to invite (or throw out) whatever guest you want at your home? You have the same right even if they don't say things you find offensive, heck, even if they just tell you pleasant things...

>I decide to leak trade secrets of my employer for profit. Should the First Amendment protect me from being fired and sued for this?

Isn't that covered by copyright law (or similar)?

The point wasn't "practical limits to free speech" regarding a "mob hit" request or some non-existant and never argued obligation to let people in your house if they speak lest you prevent them from expression (?), but how more abstract (or open to interpretation) restrictions can be used to effectively limit actual free speech.

Not to mention "private entities such as your employer can restrict your speech in many ways", like a not so uncommon case of you saying something they don't like on your (unrelated to work) personal social media, in which they can just fire you. Or the social medium itself can censor you.

Making the FA protections kind of moot, in a time when it isn't the government that has to do the censoring anymore, while the public just gathers on 3-4 tech behemoths platforms.

> Isn't that covered by actual murder (or conspiracy to commit murder if it isn't seen through) charges, unrelated to free speech?

> Isn't that covered by the right to invite (or throw out) whatever guest you want at your home?

> Making the FA protections kind of moot, in a time when it isn't the government that has to do the censoring anymore, while the public just gathers on 3-4 tech behemoths platforms.

I don't understand your points. You're both mixing concerns and splitting them, seemingly at random.

>I don't understand your points.

Here's the Cliff Notes version:

The examples you brought up as arguments to why free speech can't be absolute (which I didn't argue for in the first place) are contrived and unrelated to free speech.

They are also already covered by existing laws, such as laws against conspiracy to commit murder, about the right of exclusion, etc. If anything I'm separating concerns, mixed up for no good reason.

As for my statement about FA, it's pointing how its protections are rendered moot, since they don't apply to private businesses and thus don't protect speech (the kind that matters, not mob hits) in places where the public discourse really happens nowadays. So, it's not "sufficient free speech protection" anymore.

I added it to further the discussion, what with FA being the very topic of this subthread, and not some randomly "mixed concern"...

> They are also already covered by existing laws

The First Amendment supersedes law by determining whether it can be law at all, so whether it's covered by "law" is actually only half the story.

> The examples you brought up as arguments to why free speech can't be absolute

I started with deliberately stupid examples to make my point: Free Speech was always clearly limited, by necessity.

> it's pointing how its protections are rendered moot

That in itself is debatable. What evidence do you bring that this is somehow worse than it used to be? It used to be the case that, to get _any_ significant speech, you had to get your work published. Now you can just shoot it off on Twitter, Reddit, HN, take your pick.

>I started with deliberately stupid examples to make my point: Free Speech was always clearly limited, by necessity.

Which is neither here, nor there. Conspiracy to commit murder, as per the "mob boss gives an order example" would always be illegal regarless of our "free speech" stance, and the First Amendment didn't come into play determining whether that "[could] be law at all".

It was rather the other way around: the First Amendment was drafted with the certainty that such a thing isn't about free speech and will always be illegal.

> It was rather the other way around: the First Amendment was drafted with the certainty that such a thing isn't about free speech and will always be illegal.

This isn’t really backing up your point that the First Amendment isn’t sufficiently protecting free speech.

Not so much, there is plenty of other type of speech that is protected by the first amendment and is illegal in countries that don't have such thing in their constitution. For exemple, in France, saying "Macron is trash" can get you to jail (https://rmc.bfmtv.com/actualites/police-justice/insultes-con..., https://www.lepoint.fr/societe/une-quinquagenaire-jugee-pour...)
Technically not jail, there's only a fine allowed for the crime of "outrage à personne dépositaire de l'autorité publique" (insulting a public authority figure) and "injure au président de la République" (insulting the president of the republic).

Not great, but not terrible (jail).

> Private entities such as your employer can restrict your speech in many ways.

Fun fact: Europe actually has better protections for free speech for employees. Even if you're a hardcore Nazi taking part in actual Nazi rallies, unless you're wearing company clothing or are a high-ranking corporate official, you can't get fired for that. And when you, say, contribute to an open source project in your non-work time on your own computer, your employer doesn't get any rights to that code.

I think while this is a popular way to think about these things, it doesn't offer enough explanatory power for when things seemingly "go wrong":

Rights afforded by a state are restrictions on a state's power over its subjects. But as the state holds ultimate authority, the only way these rights are upheld in practice is through a system of self-imposed indirection and bureaucracy that mostly exists to limit the power of any one individual operating the state, rather than the state as a whole.

The First Amendment means whatever the state wants it to mean. The Supreme Court can make a case-specific ruling one way or another but it intentionally holds no direct power. A police officer can literally get away with killing you if they can construct a scenario that gives them sufficient justification to do so. The problem with intelligence agency is that by necessity they have less red tape holding them down and they're thus in practice far less limited in how much power they can wield.

States are authoritarian and oppressive by default. They're only held back by self-imposed limitations. But those limitations only exist at the behest of the states themselves. Try and openly plan to dismantle a state (using violence or not) and most states will abandon any pretense of freedom of speech in a second.

> Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc. Private entities such as your employer can restrict your speech in many ways.

That's all true and should be true, but it's also possible to take these limitations too fare, and we have.

>incite violence

>threaten them

You absolutely can. It just has to be nonspecific. "Kill all lannisters" is fine. "Kill x lannisters in y mall at z time" is not. See : Brandenburg v Ohio, Schenk v US, Hess v Indiana.

>interfere with others' activities (sing loudly in a movie theater),

lmao what? You can absolutely do that. the theater will kick you out but you can absolutely not be arrested for it. what an absurd claim.

>you also can't harass people

You can absolutely do that, to a degree.

>distribute copyrighted information that isn't yours

Not really related to 1A

>Private entities such as your employer can restrict your speech in many ways.

That's not 1A. 1A specifically applies to the government.

(comment deleted)
They aren't compatible with the first amendment. But at this point, those rights are a joke and and all three branches of our government regard the constitution as toilet paper.
I don't like these gag orders but I can see times when they are needed. Each person has a right to a fair trial. So the courts sometimes have to suppress information from the public to avoid potential jurors seeing information about the case. They must only judge guilt based on what they hear in court not in the media.
So the whole of society must be kept in the dark? No, jurors should simply judge on the evidence presented in court, and those looking for unwarranted (sadly, not literally) secrecy should look for other ways to continue their insidious conspiracies against people.
>jurors should simply judge on the evidence presented in court

I don't know if humans are able to ignore evidence they have heard outside of court. We are not good at only including one set of information when making judgements.

Right, but you're advocating keeping the whole of society in the dark versus relying on twelve people to be fair, which is what they're told to do. I would say that the latter is better than the former because of the immense harm keeping the whole of society in the dark. It's a numbers game.
All of society benefits from the right to a fair trial. But, most of the time gag orders are abused and no one benefits.
The way I propose does not preclude a fair trial. The way you propose (i.e. the status quo) precludes an informed electorate and introduces perverse incentives for those in power.
I disagree but that's okay :)
Rather than disagree you might point out why with reference to the points I’ve made. Comity is only an end in itself in, ironically, cultures that do not value free speech and hence, put truth beneath social harmony. The idea that I could be put on a jury and be unwilling or unable to ignore what a journalist, of all people, had relayed about a case, is risible, and I can bet I’m not alone.
I think that the way you propose does preclude a fair trial as it biases the jury but we've already covered that and come to different conclusions.

I agree that free speech has significant value and restrictions should only be put in place when required to uphold other rights.

I'm sure you're not alone in your opinion that a jury is able to ignore what they've heard about a case in the media. However you do disagree with the current judicial system of most developed nations. That doesn't necessarily make you wrong. I think there is merit to the argument you're making, I just am not convinced that people can ignore information like that.

https://juryanalyst.com/blog/the-power-of-media-coverage-how...

https://www.canlii.org/en/commentary/doc/2019CanLIIDocs2798#...

Gag orders are rarely used for this purpose.

The information that so-and-so parties provided some information (without disclosure of that information) in response to a lawful request will usually not predudice a trial.

What gag orders are for is a) avoiding tipping off the subject of an active investigation b) avoiding general knowledge or disclosure of key sources of information and investigative methods used by law enforcement and c) concealing the general scale, nature and purpose of surveillance activities from the general public.

> Gag orders are rarely used for this purpose.

I agree, but the only time I think it's justified is when it's to protect the right to a fair trial.

There are plenty of laws that aren't compatible with our constitution. Judges will laugh a lawyer out of the courtroom who uses constitutional arguments, and your case will go nowhere.
Are you still like first amendement don't you number

@_sib_ra10

Our rights are written in a document. The government is made up of people. There can be a large disconnect between the two.
Yes, they can. They also can perform illegal searches on Americans, and routinely do. To the tune of hundreds thousands times a year: https://www.reuters.com/world/us/fbi-misused-intelligence-da...

There is absolutely no consequences to anybody for this. If you're going to ask how US citizens tolerate such blatant abuse, and why they don't do something about it - that's a very good question. Please get back to me if you find any answer to it.

Yes, the thing people gloss over is that laws are only as good as the people ruling on them, and not only is the process of selecting supreme court judges in the US a farce, one of them is openly defending his own corruption now.

In such cases, a well written, clear law on freedom of speech only increases the distance between what people think they have, and what they actually have.

Well, the founding fathers intended for the First Amendment to apply only to acts of Congress, and maybe not even then (for example, just six years after ratifying the Bill of Rights, founding father and second President John Adams signed the Sedition act [0], which criminalized false and malicious statements against the government).

It took over 125 years before Supreme Courts started reinterpreting the First Amendment to apply to some government actions that weren't acts of Congress, but there are still tons of situations where regular people can restrict free speech. For example, in Frederick v. Morse, while the Olympic torch was running through some town in Alaska, a public high school student unfurled a banner that read "bong hits 4 Jesus". Despite this not being on school grounds and the student not going to school that day, the school suspended him explicitly because of the speech on his banner, but the SC said that's fine.

(Sidenote: I wouldn't look to the SC for coherent reasoning; the SC has been an absolute dumpster fire for all but the Warren court and parts of FDR's court. Hell, three current Justices (Roberts, Kavanaugh, and Coney-Barrett) worked on George W Bush's legal team in the democracy-negating Bush v. Gore case)

[0] https://en.m.wikipedia.org/wiki/Alien_and_Sedition_Acts

Free speech does not equate to unlimited absolution from consequence
> but then apparently the police (FBI) can restrict the free speech of Americans without any court involvement at all?

are you sure about this? As far as I understand "gag orders" can only come from a judge. Of course the FBI could request strongly that you not talk about something but I'm not sure it would hold legal weight.

Having been on the receiving end a bit, the gag orders don't come from the FBI directly. The FBI can ask you not to say anything, but you can ignore that without any legal repercussions. Any gag order that matters is issued by a judge.
They do need a court. Subpoenas are issued and overseen by the judicial system, any gay order has to be signed by a judge. The FBI can't unilaterally censor you.
The USA is a country of laws. It's possible that people submitting packages are submitting illegal malware; spyware, ransomware, software to steal crypto money, or run illegal ticket-buying bots. Ethical oversight is baked into the institutions through governance structures. Institutions aren't perfect. Also there tend to be more complaints in the media about a country's institutions than in regions where there is not a free press. So the voices complaining online don't necessarily correlate with where the problems most lie.
Describing the US as a country of laws is a little funny. The mere existence of laws does not imply much.

Your examples are even weirder. How would such malfeasance justify clandestine observations? That is clearly disproportional, thus unethical.

Claiming governance structures were "baked into" institutions is pure hopium. Democratic oversight means, there must be transparency enabling you as a citizen to detect and react to misconduct, at least by proxy.

The "free press" isn't free to report and investigate such subpoenas, obviously.

If law enforcement was never allowed to engage in clandestine operations then it would hamper their ability to build a case against and/or apprehend criminals. Case in point, organized crime syndicates.

This is why the majority of your fellow citizens disagree with you and are fine with the current state of affairs.

That seems like kind of a fabricated boogeyman, though. I have an extremely hard time thinking of anyone I know whose been affected by an organized crime syndicate, but I can immediately bring to mind a whole host of injustices suffered at the hands of government agencies, from bogus tickets to civil forfeiture to imprisionment for victimless 'crimes' (and that's not even accounting for blanket stuff like xkeyscore or spending my tax dollars on nonsense like the iraq war - all arguably way worse than any criminal organization without government backing could ever hope to inflict)
What about a ransomware, phishing or data breach victim? Cybercrimes are often committed by organised criminals and investigating them seems like the most obvious reason for the DOJ to issue a subpoena to PyPI.
This is my high school buddy’s dad:

https://www.democratandchronicle.com/story/watchdog/2013/12/...

Three of my teenage friends were in his basement when the FBI kicked down the door and stormed in armed to the teeth.

Perhaps you’re fine letting thieves and murderers get the upper hand but the rest of us are not.

Consider yourself lucky that criminals haven’t had much of an impact on your life.

Sorry, what point are you trying to make?
A very basic one: organized crime does in fact exist (contra to claims of bogeymen) and law enforcement benefits from clandestine investigations.

It is a trade-off. The downsides have been enumerated ad nauseam on hacker forums for decades and compared to the reality of organized crime comprise just a small percentage of the ill effects experienced in a relatively low corruption society like the United States.

No one is trying to claim organized crime does not exist. They are claiming that the harms from organized crime may not be as bad on the whole as the harms from some of these laws intended (at least in part) to combat it.

This does not, of course, mean that the harms to certain individuals from organized crime aren't worse. But governing based on a small number of emotional anecdotes, and ignoring the broader harms being perpetrated to placate that vocal minority, is deeply irresponsible.

What is deeply irresponsible is ignoring the benefits of clandestine operations by law enforcement in a vain attempt to adhere to some kind of free and open source information ideology.
I think where you and I might be diverging here is in our definitions of 'thief' and 'murderer'.

I don't see a difference between, say, a capo that orders a hit, and a member of congress who votes for a foreign 'police action' - save for that the congressmember has much, much higher numbers.

Same goes for a bank robber vs. a bank exec who gets a multimillion $ payout from bailout funds - we're impressed if the bank robber cracks a million - but it's like "that makes sense" when the exec walks away with eight figures of tax dollars.

I don't know anyone whose been killed by a mob hit, but I know soldiers who have lost their lives to bullshit foreign wars, and literally everyone who pays taxes lost money to the villains in 2008.

I believe criminals have had a huge impact on my life - they just all got there through 'legitimate' channels, which IMO makes no difference to whether I'm poorer or people are dead.

> whose been affected by an organized crime syndicate

I can’t think of anyone I know who has been affected by holes in the ozone layer. Must be a fabricated government boogeyman designed to force me to buy an inferior fridge.

Law enforcement agencies have been quite effective in controlling them over the last few decades (that and they’ve been replaced by foreign drug cartels..). It was probably quite different back in the 60s or 70s

> I can’t think of anyone I know who has been affected by holes in the ozone layer. Must be a fabricated government boogeyman designed to force me to buy an inferior fridge.

There are many [1] counties in California that come immediately to mind - but I digress.

I'll readily admit that things have changed - organized crime was indeed a much bigger problem in the past - but I might argue that even then the fault lay not with a lack of enforcement, but the existence of really, really dumb laws (prohibition). I might further argue that what organized crime is still problematic, is also a legislative rather than an enforcement issue (current prohibition, which we euphamize as the 'war on drugs').

Even if it's enforcement that's doing the work of eliminating the effects of organized crime on actual citizens - the potential for harm is way bigger from an organization with a monopoly on violence, a state mandate, and practically unlimited coffers.

1 - https://en.wikipedia.org/wiki/List_of_California_wildfires

In a lot of ways, being 'a nation of laws' means the officeholders can evade any kind of personal responsibility by asserting that they're just one cog in the legal gear wheel. Which one? Well that can take years of litigation to establish.

Of course, the idea is that people are corruptible whereas laws are clear and neutral, but reality falls far short of this ideal. Any system can be gamed and ultimately captured; the more widely accountability is distributed, the less the probability of its timely application.

> Ethical oversight is baked into the institutions through governance structures.

Kind of a shocking assumption to make. Over the past several decades it has become increasingly apparent how our governing structures have no inherent relationship with ethics.

You’re extrapolating incidents that are being called out in the press to improve the system onto vast legislative infrastructure that is operating day after day for 100’s millions of people in this country.
(comment deleted)
At least they get to subtly communicate they can't talk, instead of being Jack Ma'd.

The constitutional justification is the same one behind not being allowed to yell 'fire' in a crowded theatre if there is none, or not being able to go on TV and threaten the Judge overseeing your case - 'the constitution is not a suicide pact'. [https://en.wikipedia.org/wiki/The_Constitution_is_not_a_suic...]

As to if it is being abused? Guaranteed. Being prevented? Not effectively. Only the occasional leak of the abuse and corresponding consequences (if any) seem to be counteracting it, and even then not well.

Sunlight is the best disinfectant, and most of the national security apparatus is solidly in the dark, and has been for a long time.

> How does the ethical use of this prolematic tool get ascertained? Where and how is the democratic oversight implemented? How is misuse treated and prevented?

I can't speak specifically to this case, but in general when asking a judge for the warrant they also provide compelling evidence that harm would come from disclosure. The judges weigh the rights of the targeted and other parties that would be subject to a gag order against the greater good.

To answer your last two questions, all gag orders eventually expire. It isn't a prohibition against the impacted party speaking out, just a delay. They can go directly to the judge or appeal to a higher court.

> It isn't a prohibition against the impacted party speaking out, just a delay.

It’s exactly this “it’s totally fair, surely it’s not ridiculous” attitude that shows how the powers control the people.

Gag orders and secrecy agreements can definitely be indefinite and regularly are.

https://web.archive.org/web/20220809113138/https://cdt.org/i...

Assuming it's always ridiculous doesn't seem like a position any more enlightened.
Possibly safer for people's rights, though.
> Where and how is the democratic oversight implemented?

What democratic oversight? This is the United States we're talking about lol.

> Such subpoenas are clandestine surveillance of citizens by their state. The problem with such types of surveillance in particular is the lack of accountability.

I never know how to interpret statements like this. The fourth amendment guarantees court oversight over search and seizures. A court signs off on every subpoena issued anywhere in the USA. Are you making this argument from the perspective of "I didn't know courts were involved" or "I don't view courts as sufficient oversight".

If it's the latter... what's your alternative? Eliminate gag orders (which is all this is) entirely? You realize that there's a lot of stuff that happens in courts that we all agree should not be public, both for privacy and law enforcement reasons. Why get upset over this one particular thing?

FISA judges are the oversight on foreign surveillance, but there is no (public?) oversight of national security letters.
FISA judges are not oversight of anything, as we learned, they almost never refuse a request, and even if there's a threat of such refusal, FBI could just lie to them, and they would stamp it, and when the lie comes out, nothing happens. FISA court is just a smokescreen to provide an illusion of oversight.
> How does the ethical use of this prolematic tool get ascertained?

Via the judicial system

> Where and how is the democratic oversight implemented?

In congress

> How is misuse treated and prevented?

Through the judicial system and congress

Except for other "states" they don't even have the ability to communicate about subjects like this.
"Ethics" and "democracy", as if they were a real thing... Both are a tool to fights your adversaries, but they are not something you can assume as given.
A theoretical case were an attacker leveraged some package hosted on PyPI could maybe become aware of investigations and destroy left-over evidence. But I guess a huge packet manager like this is too generic a target for such contraint to really work.

> How does the ethical use of this prolematic tool get ascertained?

It probably doesn't get ascertained, sadly. I think the advantages for investigations that might occur if people communicate more strategically is not worth the risk of political procecussions, which I believe are on the rise for a while now.

Sounds like they got a National Security Letter.
Does not need to be an NSL to have a non-disclosure attached. Could be a relatively minor (not very spooky) federal investigation.
How does that work with in combination of freedom of speech? Is it one of those cases, where someone has to be brave/foolish enough to disobey and take it to the supreme court?
A judge signed off on it. Which means that the State made a case for the subpoena to include a non-disclosure.
I'm going to go ahead and guess "signed off on" was more like "rubber stamped"
Most likely... but the party who was served the order can file for appeal if they are willing to go that route. That said, it doesn't mean any such appeal with favor the party served the gag order.
And the case likely was "we swear it is very important for national security, trust us!" and that was enough. Search request is almost never refused, e.g. FISA court approves over 99% of them. And if the court already deemed the proof strong enough to do the search, surely it's strong enough to put a non-disclosure on it if asked.
> How does that work with in combination of freedom of speech?

The government is not preventing you from expressing your free thoughts and opinions. They are compelling you to not disclose the details of something you had no knowledge of before they asked you about it.

Nothing is stopping you from writing a blog post about how it is unfair to seek records of a potential criminal, but you cannot write about how it is unfair to seek the records of Bob Jones when you had no other reason to believe Bob was anything but a regular user.

But you could post a unique blog post such as that about every one of your users.
(comment deleted)
(comment deleted)
Agreed. It's like the librarians who responded to the Patriot Act by putting up "The FBI has not been here" signs.
> That's suspiciously specific. Sounds to me like they also received some other subpoenas they aren't allowed to talk about.

It could be, it could also be that they were trying to communicate both the timing of the subpoena string and why they are able to talk about it, and there aren’t any others.

It already says at the beginning when they were received (not mentioning potential others).

It's definitely unnatural to say again 'as allowed by the ones received in those months we already mentioned'.

I always wondered why you couldn't get all your subpoenas passed through an intermediary who is instructed to post about them before reading them.
Because then men with guns come and politely explain why they don't like that. But, seriously, for the same reason as you can't stand up to absolute power in any other way.
“The lack of a non-disclosure order”
Seems like the non-disclosure order did not say anything preventing them from disclosing said non-disclosure order itself
I don't think you can infer that.

A non-disclosure order probably does exist for other subpoenas.

So just yesterday PyPI announced they're retiring cryptographic signatures: https://news.ycombinator.com/item?id=36044543.

It's hard to keep those things separated. I would very much like the code submitted to PyPI be protected end-to-end by cryptographic signatures, when PyPI has either no resources, or no spine to stand up to a government. Any signatures, even PGP, which should be in place until someone provides better mechanism.

I don't have a problem with this as it was 5 particular users and not "give us all the data for for all your users". They didn't really have much of a choice. I don't think they would have had a choice in any of the 5 eyes countries or their allies
Amazing how upset users here get over the very reasonable response to very normal police work.
Agreed - how else was the DOJ supposed to do their job? They clearly need the data for an investigation. No need for PyPI to give information about how current users can alter their accounts to thwart future requests.
Normal police work doesn't go fishing for the IP addresses (potentially millions of users) of everyone who downloaded a package.

> "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames

Do you feel the same way if the cops are receiving the IPs of everyone who downloaded yt-dlp? IP addresses and timestamps resolve to physical locations and oftentimes street addresses.

That doesn't make any sense though. What benefit would DOJ get from getting the IP address of everyone who downloaded ytp-dlp? They aren't the enforcement arm of google's terms of service, which is a civil matter.

Even if they were, and the DOJ was going for a dragnet operation to go after tools that could potentially infringe terms of service of big corporations, they would go after every tool and every fork. Not just 1 package. But again, what court would allow such action and why?

If I was in the DOJ and was investigating a malicious package uploaded to PyPI, I would ask for the IP's of the downloaders to see if the uploaders dun goofed and downloaded their package shortly after uploading off VPN. Or to find out if any major corporations were impacted by downloading the malicious package and to inform them.

In the US at least, it has been ruled that an IP address is not sufficient evidence to link activity to any particular person. You could have been hacked for example.
In the US they don't need evidence or a warrant to put certain people they deem surveillance-worthy under 24/7 surveillance.
(Deleted comment as it was wrongly assuming bias)
no. they wanted the downloads by randoms. we don’t store those with IPs
I think you're reading it wrong too - it says "IP download logs of any Python Package Index (PyPI) packages uploaded by the given usernames". So that's anyone who downloaded those packages, not just the specific users' download activity.
Exactly. This is like the police going to a store with a list of suppliers and demanding personal data of everyone who bought any of those suppliers' products. That's well beyond "normal" but somehow for digital data its ok?
Yeah, I feel like this crowd sometimes forgets that the department of justice exists first and foremost to keep us safe.

With PyPi hosting a ton of malicious packages and malware, certainly I am not morally opposed.

Same with the dozen street cameras at every intersection in China, right? Right? :)
It's truly disheartening to see examples where someone (presumably a real human) thinks that all law enforcement, across all nations and times, and in all cases, are equal.
I didn't say equal, did I?
They are equal insofar as they exist for the same purpose.
Well when the convergence looks like it’s on the horizon, call us paranoid.
You could reasonably argue it exists foremost to keep wealthy, well-connected people and organizations safe, and to punish their adversaries.
That’s a different argument, though. And it’s a hard argument to make; nowhere in the Constitution does it say “Justice for wealthy people only.” The intent of the Justice system is not nefarious; it merely exists to enforce the law.

I reject the vibe that “law enforcement bad, freedom good, tear it all down.” It is not at all constructive or thoughtful. I fear that people are forgetting that everyone is really on the same side, that we do really want to prevent crimes, and fairly and equitably. It’s ok to want a more fair and equitable Justice system, but in my opinion the solution is not to attack every law enforcement action with emotionally charged language.

Total speculation on my part but PyPI hosts yt-dlp, the unauthorized video downloader. https://pypi.org/project/yt-dlp/
I would think the government has bigger fish to fry than to spend time subpoenaing yt-dlp.
Not a US cititzen, but "The government" is a wide term and any law enforcement agency would fit this, including the ones that are responsible to deal with things like copyright enforcement - that's exactly the type of fish they exist to fry ...
Given the discussion around how lacking PyPI supply chain security is, how juicy of a target it is for attackers, and how critical infrastructure is probably relying on PyPI, yt-dlp is the last thing on my mind.
FYI for non US readers ...

In the US, subpoenas come from the Justice Department (either state or federal depending on the crime for which evidence is being sought). The court that issued the subpoena is on it, and the person or entity being served, has the right to see why some government agency felt it could aid in the uncovering of a crime that had already been committed. The person or entity then has the opportunity to challenge that in court prior to complying with it. This is sometimes informally called "quashing the subpoena." From my sister-in-law who is a defense attorney, the most common result of challenging a subpoena is to get what it asks for narrowed down to just what is plausibly responsive.

In the article, this response: As a result we are currently developing new data retention and disclosure policies. These policies will relate to our procedures for future government data requests, how and for what duration we store personally identifiable information such as user access records, and policies that make these explicit for our users and community. Is good practice for limiting what a subpoena can request (you can't give what you don't have).

At Blekko we logged access records in such a way that we could use PII for 48 hours and then it was deleted. The CTO, Greg Lindahl, is a huge privacy advocate and this sort of architecture made it possible to get information to improve our ranking and service without compromising people's privacy. In practice I don't think any agency could go from "we have a suspect" to "issue a subpoena" in 48 hrs so it was a useful way for us to stay out of the crosshairs. The most interesting event was the FBI asking for information on IP addresses that had accessed their honeypot CSAM site. That turned out to be some of the machines in the crawling cluster. Given that the site was outside the crawl "horizon" and didn't rank (very few sites linked to it) it didn't even make it into the cache for rank analysis. But in that case the turn around time was impressive. Of course that is because they were just using their own logs to generate subpoena requests.

You can get subpoenas that ask for data longer than your window, in which case you have to have a longer one, even if the reachback is shorter.

Watch out for smaller jurisdictions that might have “you should have expected” laws that says your 48hr window is too short.

As I recall (and I'm not a lawyer so don't rely on this advice) the lawyers had advised that as long as the retention period was published, even if a subpoena asked for a longer look back you could meet your obligation by returning "all the data you had" which would only be 48hrs worth.

Had a jurisdiction said, "You should have expected ..." I expect our response would have been, "We have published what we retain, me meet conform to federal and state laws you knew ahead of time we wouldn't have more than 48 hrs worth."

That said, jurisdiction when it comes to the Internet is always kind of "weird". Did you use the web service in your house in Columbus OH, or did you use the web service on a server in a data center in California? Also as I recall our TOS also had a requirement that any legal action be brought in California but I don't think we ever tested that in court.

I tested the court jurisdiction a few times, but had mixed results. I tried to quash first anyhow.

The NSA and SS can get quite testy about it and make you wish you were dealing with the FBI.

Google is a pretty big fish themselves.

What usually happens is the large corporation lays out a case like "yt-dlp is responsible for billions in damages" and they press the DOJ to investigate and prosecute.

AFAIK Google hasn't even taken any civil action against y(ou)t(ube)-dl(p) at all, that was all the music industry.
One would think that yes.... but this is the U.S. :/
I wouldn't be surprised if it was more of AI based impersonation stuff. AI in the government is big because people can use it impersonate people as a form of identity fraud.
The FBI has it's own 'copyright enforcement' division who has as their sole job enforcing copyright, and has it's own dedicated funding

[https://archives.fbi.gov/archives/news/testimony/intellectua...]

Isn't copyright infringement a tort not a crime? Why is the FBI involved at all?
Depends on the level of infringement generally.
Because the people rich enough to own big copyrights can afford politicians.
https://en.wikipedia.org/wiki/No_Electronic_Theft_Act

> Introduced in the House as H.R. 2265 by Bob Goodlatte (R–VA) on July 25, 1997

> Committee consideration by United States House Committee on the Judiciary and United States Senate Committee on the Judiciary

> Passed the House on November 4, 1997

> Passed the Senate on November 13, 1997

> Signed into law by President Bill Clinton on December 16, 1997

Ah, back in the days of bipartisanship.
Every time I'm reminded of this law, specifically the year of its passing, I'm newly surprised. With some digital authoritarian laws, I'm acutely aware that they are only recent history (eg FOSTA, DMCA, bank surveillance, "Patriot" act). But with the NETA and the CFAA I have to work at remembering that things weren't always this way, as recently as only a few decades ago. Like imagine the different world we could be living in if they had failed at becoming law and things had developed without them.
The nominal reason for the passing of the law was widespread use of VCRs, which allowed non-centralized and difficult to control recording/copying, distribution, and at home playing where usage couldn’t be monitored (like at a theatre which can be audited).

Before that, it would involve something like literal film, which didn’t scale well, and was too expensive and difficult for a typical person to do at home. It still happened, but was VERY niche.

With VHS/VCRs, someone could spend a couple thousand dollars and make hundreds of bootleg copies of any blockbuster video out there from their garage, and it was easy to literally go to Blockbuster(tm) and get an copy to duplicate without being tracked. Easy money. Folks would sell them out of the back of (literally) vans, or through friends, or via flea markets, etc.

It’s still super prevalent in Asia, using DVD/Blu-ray’s.

In the US, it then eventually got applied to the internet, because it was even easier and more scalable using computers, and harder to track down the culprits.

It’s all about money in the end of course.

(comment deleted)
The FBI does sting operations to arrest homeless people who sell bootleg movies and bags on the street.
Amazingly hilarious comment given the history of copyright prosecution.
Given PyPI has been a vector for distributing malware into dependency chains, wouldn't you think that would be a more likely target for the DoJ over one of HN's favorite axes to grind?
Unlikely, due to:

> "Records of all Python Package Index (PyPI) packages uploaded by..." given usernames

> "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames

I don't think they'd want a list of packages uploaded by a given user if they were after yt-dlp devs. They'd be asking for a list of maintainers of a given package.

If yt-dlp was illegal the first thing they’d do is a takedown request, not a subpoena but leave it online.
(comment deleted)
That's if they want to go down the DMCA route and aren't using a subpoena in a different case.
But what if they want records on everyone who downloaded a tool?
Thanks, I was wondering what it might be about. That makes some sense.
No it doesn't. Noone at the government level gives a shit about a youtube downloader package, typosquatting would be way more likely. Pypi is riddled with malware AFAIK, they don't really moderate it.
I took a report down within 3 minutes of upload today. We have regularly received comments from our 3rd-party reporters that we are the most responsive.

You are wrong.

yt-dlp is everywhere - why would they go after pypi and not the source at https://github.com/yt-dlp/yt-dlp
Not that I necessarily believe this is happening, but this can be a case of making an example out of anyone that wants to distribute the software they wanted censored via chilling effects.
Ah, fair. Wouldn't be the first time the US Gov't did that
It seems much more likely that some typosquatter managed to compromise the security of government sites by uploading malware, and Uncle Sam wants to catch the culprit.
Or they're chasing threat actors, ransom groups, etc as part of a larger investigation.
What an odd article and release statement. It’s almost as if they’re signaling w-out literally signaling the parties of interest.

Surprised the doj didn’t issue any gag orders.

Exactly. I guess the transparency is nice but at what point are you potentially helping someone cover their tracks who may or may not actually deserve that help?
One gets the impression that this was an artfully crafted way around the specifics of the gag order, to disclose whatever wasn't specifically prohibited by it. IANAL.
> as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023.

Yeah no way they haven't had other subpoenas then.

> "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames

This is way overbroad. The fact that a judge granted this is very bad.

We get "please provide the logged IP addresses of user X" subpoenas on a weekly if not daily basis. Which law school did you go to so I can tell our corp counsel they've been doing it wrong and stop asking?
Note that GP complains not about the request for IP addresses of user X, but the request for IP addresses of anyone who downloaded content uploaded by user X.
You should re-read the quote. This was not a request for the IP addresses of the users in question, but for the everyone that downloaded any packages uploaded by those users.
You're right. Sorry that I implied that was the only thing they asked for. But the point still stands that it's very common to be compelled to provide the equivalent of "tell me everything you know about this IP address", and our legal has said we (usually) legally have to provide it.
It's hard to say that it's "overbroad" without knowing the details of the situation.

It's not hard at all, on the other hand, to imagine situations where this would be a reasonable request. Probably the most obvious would be if the packages contained material which was illegal to possess or distribute (like CSAM). Another would be if the packages were being used as part of a malware C&C operation -- knowing what IP addresses downloaded the packages would aid in determining the scope of the campaign.

Dude I thought it’s Chinese Gov. Hey, America!!!
Good on the PyPi folks. This is an incredibly well done disclosure, an example to be sure.
"9. IP download logs of any Python Package Index (PyPI) packages uploaded by the given usernames"

This was the point where I was wondering if this is really about some malicious packages or something more along the lines of copyright infringement software.

This definitely seems like a significant element of the ask, but for any popular package a list of all the downloaders would be pretty overwhelming in size (and I think of very limited utility). I'm guessing that some versions of some more obscure package(s) were identified as being used in an attack and they're either trying to identify potential attackers or other victims (or both) of that attack.

From a 2021 article[1] about packages used to deliver malware "we have alerted PyPI about the existence of the malicious packages which promptly removed them. Based on data from pepy.tech, we estimate the malicious packages were downloaded about 30,000 times."

For comparison yt-dlp has tens of millions of total downloads and gets downloaded over 70,000 times every day [2]

[1] https://jfrog.com/blog/malicious-pypi-packages-stealing-cred...

[2] https://pepy.tech/project/yt-dlp